add ca-certificates from Debian and install them in openssl component.

component/ca-certificates/buildout.cfg

+# CA certificates
+
+[buildout]
+parts =
+  ca-certificates
+
+
+[ca-certificates-sbin-dir.patch]
+recipe = hexagonit.recipe.download
+url = ${:_profile_base_location_}/${:filename}
+md5sum = 0b4e7d82ce768823c01954ee41ef177b	
+filename = ${:_buildout_section_name_}
+download-only = true
+
+[ca-certificates]
+recipe = hexagonit.recipe.cmmi
+version = 20111211
+url = ftp://ftp.free.fr/mirrors/ftp.debian.org/pool/main/c/ca-certificates/ca-certificates_${:version}.tar.gz
+patches =
+  ${ca-certificates-sbin-dir.patch:location}/${ca-certificates-sbin-dir.patch:filename}
+patch-options = -p0
+configure-command = true
+make-targets = install DESTDIR=${buildout:parts-directory}/${:_buildout_section_name_} CERTSDIR=certs SBINDIR=sbin

component/ca-certificates/ca-certificates-sbin-dir.patch

+--- Makefile.orig	2011-12-11 20:54:02.000000000 +0100
++++ Makefile	2012-01-09 17:36:55.059392824 +0100
+@@ -17,7 +17,7 @@
+ 
+ install:
+ 	for dir in $(SUBDIRS); do \
+-	  mkdir $(DESTDIR)/$(CERTSDIR)/$$dir; \
++	  mkdir -p $(DESTDIR)/$(CERTSDIR)/$$dir; \
+ 	  $(MAKE) -C $$dir install CERTSDIR=$(DESTDIR)/$(CERTSDIR)/$$dir; \
+ 	done
+ 	for dir in sbin; do \
+--- sbin/Makefile.orig	2011-12-11 20:54:02.000000000 +0100
++++ sbin/Makefile	2012-01-09 17:31:45.207387898 +0100
+@@ -3,9 +3,12 @@
+ #
+ #
+ 
++SBINDIR=/usr/sbin
++
+ all:
+ 
+ clean:
+ 
+ install:
+-	install -m755 update-ca-certificates $(DESTDIR)/usr/sbin/
++	mkdir -p $(DESTDIR)/$(SBINDIR)
++	install -m755 update-ca-certificates $(DESTDIR)/$(SBINDIR)

component/openssl/buildout.cfg

@@ -5,6 +5,7 @@
 
 [buildout]
 extends =
+  ../ca-certificates/buildout.cfg
   ../zlib/buildout.cfg
 
 parts =
@@ -27,5 +28,7 @@ configure-options =
 # it seems that parallel build sometimes fails for openssl.
 make-options =
   -j1
+make-targets =
+  install && rm -f ${buildout:parts-directory}/${:_buildout_section_name_}/etc/ssl/certs/* && for i in ${ca-certificates:location}/certs/*/*.crt; do ln -sv $i ${buildout:parts-directory}/${:_buildout_section_name_}/etc/ssl/certs/`${buildout:parts-directory}/${:_buildout_section_name_}/bin/openssl x509 -hash -noout -in $i`.0; done; true
   LDFLAGS="-Wl,-rpath=${zlib:location}/lib -Wl,-rpath=${buildout:parts-directory}/${:_buildout_section_name_}/lib"
   SHARED_LDFLAGS="-Wl,-rpath=${zlib:location}/lib -Wl,-rpath=${buildout:parts-directory}/${:_buildout_section_name_}/lib"