diff --git a/core/certs/build b/core/certs/build
new file mode 100755
index 00000000..d9b535d8
--- /dev/null
+++ b/core/certs/build
@@ -0,0 +1,4 @@
+#!/bin/sh -e
+
+mkdir -p "$1/etc/ssl"
+cp "cacert-$2.pem" "$1/etc/ssl/cert.pem"
diff --git a/core/certs/checksums b/core/certs/checksums
new file mode 100644
index 00000000..6d42ce8b
--- /dev/null
+++ b/core/certs/checksums
@@ -0,0 +1 @@
+6ed95025fba2aef0ce7b647607225745624497f876d74ef6ec22b26e73e9de77
diff --git a/core/certs/sources b/core/certs/sources
new file mode 100644
index 00000000..8e2a0bd0
--- /dev/null
+++ b/core/certs/sources
@@ -0,0 +1 @@
+https://curl.se/ca/cacert-VERSION.pem
diff --git a/core/certs/version b/core/certs/version
new file mode 100644
index 00000000..55f652ee
--- /dev/null
+++ b/core/certs/version
@@ -0,0 +1 @@
+2022-07-19 1
diff --git a/core/openssl/build b/core/openssl/build
index 8a3770b1..1097f146 100755
--- a/core/openssl/build
+++ b/core/openssl/build
@@ -8,8 +8,6 @@ make DESTDIR="$1" \
     install_ssldirs \
     install_man_docs
 
-cp -f update-certdata.sh "$1/etc/ssl"
-
 # Libretls is LibreSSL's libtls library for OpenSSL.
 (
     cd libretls
diff --git a/core/openssl/checksums b/core/openssl/checksums
index 05e9090d..792cd94b 100644
--- a/core/openssl/checksums
+++ b/core/openssl/checksums
@@ -1,4 +1,3 @@
 aa7d8d9bef71ad6525c55ba11e5f4397889ce49c2c9349dcea6d3e4f0b024a7a
 397851e9cc53edcb00eb068f9ad50eda04dcf2b3659fd1ba2b6f43b5e859572a
 59ce9961cb1b1a2859cacb9863eeccc3bbeadf014840a1c61a0ac12ad31bcc9e
-7f69005492f8076a23025ac22032098da7bb1753ea221f90dc0437d9934500f9
diff --git a/core/openssl/depends b/core/openssl/depends
new file mode 100644
index 00000000..b2290143
--- /dev/null
+++ b/core/openssl/depends
@@ -0,0 +1 @@
+certs
diff --git a/core/openssl/files/update-certdata.sh b/core/openssl/files/update-certdata.sh
deleted file mode 100755
index ec2a89c6..00000000
--- a/core/openssl/files/update-certdata.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh -e
-
-[ -w "$KISS_ROOT/etc/ssl" ] || {
-    printf '%s\n' "${0##*/}: root required to update cert." >&2
-    exit 1
-}
-
-cd "$KISS_ROOT/etc/ssl" && {
-    curl -LO https://curl.haxx.se/ca/cacert.pem
-    mv -f cacert.pem cert.pem
-    printf '%s\n' "${0##*/}: updated cert.pem"
-}
diff --git a/core/openssl/post-install b/core/openssl/post-install
deleted file mode 100755
index c12dca76..00000000
--- a/core/openssl/post-install
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-/etc/ssl/update-certdata.sh
diff --git a/core/openssl/sources b/core/openssl/sources
index a9a8f733..5efb70c4 100644
--- a/core/openssl/sources
+++ b/core/openssl/sources
@@ -1,4 +1,3 @@
 https://www.openssl.org/source/openssl-VERSION.tar.gz
 https://github.com/kiss-community/openssl/releases/download/generated/openssl-VERSION-generated.tar.gz
 https://causal.agency/libretls/libretls-3.5.2.tar.gz libretls
-files/update-certdata.sh
diff --git a/core/openssl/version b/core/openssl/version
index a498966e..689aeb28 100644
--- a/core/openssl/version
+++ b/core/openssl/version
@@ -1 +1 @@
-3.0.5 2
+3.0.5 3