ca-certificates upgrade for Comodo CA rebrand as Sectigo

Thu Oct 1 16:14:03 GMT 2020

curl and wget fail or need curl -k --insecure or wget --no-check-certificates
against sites such as https://astro.ukho.gov.uk/ which Chromium allows okay.
I have upgraded ca-certificates locally to current NSS_BUILTINS_LIBRARY_VERSION
2.42 whoch should hopefully handle updates for Comodo CA expiries, transitions,
and rebranding to Sectigo last year.
But curl and wget still have the same issues, so what am I missing?
Is there another global nssdb or cert.db I have to update with certutil, where
is it, and what do I run?
-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada
This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in binary units and prefixes, physical quantities in SI.]