at the time the small print have already been labored out, You will need to visit the repository of that Root CA and obtain (and confirm the hash) of that certification ahead of downloading it. You should review the https://ca-none.com/