Comment # 3 on bug 1133891 from Ludwig Nussel

calling a program other than update-ca-certificates in %post is incorrect as it
doesn't take later updates of the ca-certs into consideration. Also doing
anything with the legacy /etc/ssl/ca-bundle.pem is fishy.

What does this cert-sync do exactly? The very minimal fix would be to have a
script in ca-certifcates that calls it. The direct call from %post needs to go.

https://github.com/openSUSE/ca-certificates

Moving over to 15.2 as it's still the case there too. Back to maintainer. I can
implement the ca-certificates part if you want me to. The thing in %post needs
to go though.