Use standard update-ca-certificates on stretch and later