Wouldn't it be possible to import the new certs? It's a debian base so I think you could just download the ca-certificates package from the debian website and dpkg -i the file.