Ports+Meta: Update ca-certificates to 2026-10-20

We went from "compromised CA keys" to "the key is 4, chosen by fair dice
roll" in a matter of hours:

- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
- https://chaos.social/@fluepke/117474156947559280

Meta/CMake/ca_certificates_data.cmake

@@ -1,7 +1,7 @@
 include(${CMAKE_CURRENT_LIST_DIR}/utils.cmake)
 
-set(CACERT_VERSION "2026-09-25")
-set(CACERT_SHA256 "a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505")
+set(CACERT_VERSION "2026-10-20")
+set(CACERT_SHA256 "796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe")
 
 set(CACERT_PATH "${SERENITY_CACHE_DIR}/CACERT" CACHE PATH "Download location for cacert.pem")
 set(CACERT_VERSION_FILE "${CACERT_PATH}/version.txt")

Meta/gn/secondary/Userland/Libraries/LibTLS/BUILD.gn

@@ -9,7 +9,7 @@ declare_args() {
 
 cacert_cache = cache_path + "CACERT/"
 
-cacert_version = "2026-09-25"
+cacert_version = "2026-10-20"
 
 if (enable_cacert_download) {
   download_file("ca_certificates_download") {
@@ -17,7 +17,7 @@ if (enable_cacert_download) {
     url = "https://curl.se/ca/cacert-$version.pem"
     output = "$root_build_dir/cacert.pem"
     version_file = cacert_cache + "version.txt"
-    sha256 = "a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505"
+    sha256 = "796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe"
   }
   # FIXME: Copy file to /etc/cacert.pem on serenity
 }

Ports/AvailablePorts.md

@@ -30,7 +30,7 @@ This list is also available at [ports.serenityos.net](https://ports.serenityos.n
 | [`bzip3`](bzip3/)                               | bzip3                                                         | 1.5.4                 | https://github.com/kspalaiologos/bzip3                               |
 | [`c-ares`](c-ares/)                             | c-ares                                                        | 1.34.8                | https://c-ares.org                                                   |
 | [`c-ray`](c-ray/)                               | C-Ray                                                         | 8f30eb9               | https://github.com/vkoskiv/c-ray                                     |
-| [`ca-certificates`](ca-certificates/)           | Mozilla CA certificate store                                  | 2026-09-25            | https://curl.se/docs/caextract.html                                  |
+| [`ca-certificates`](ca-certificates/)           | Mozilla CA certificate store                                  | 2026-10-20            | https://curl.se/docs/caextract.html                                  |
 | [`cairo`](cairo/)                               | Cairo                                                         | 1.18.6                | https://www.cairographics.org/                                       |
 | [`carl`](carl/)                                 | Crypto Ancienne Resource Loader                               | 1.5                   | https://github.com/classilla/cryanc                                  |
 | [`cavestory`](cavestory/)                       | Cave Story                                                    | 2.6.5-1               | https://github.com/nxengine/nxengine-evo                             |

Ports/ca-certificates/package.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env -S bash ../.port_include.sh
 port='ca-certificates'
-version='2026-09-25'
+version='2026-10-20'
 files=(
-    "https://curl.se/ca/cacert-${version}.pem#a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505"
+    "https://curl.se/ca/cacert-${version}.pem#796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe"
 )
 workdir='.'