/etc/ca-certificates.conf
->
Set 2 certs for removal by adding “!” in front of their lines:
!mozilla/DST_Root_CA_X3.crt
!mozilla/ISRG_Root_X1.crt
(This can be done with GUI: dpkg-reconfigure ca-certificates)
Then run certificates update:
update-ca-certificates