Comment 11 for bug 1913951

It's possible in certain upgrade scenarios that the certs have been permanently blacklisted on your system.

Look at the /etc/ca-certificates.conf file to see if the following two lines start with a "!" character:

mozilla/GeoTrust_Primary_Certification_Authority_-_G2.crt
mozilla/VeriSign_Universal_Root_Certification_Authority.crt

If they do begin with "!", you need to reconfigure ca-certificates with:

sudo dpkg-reconfigure ca-certificates

That should ask you which certificates to activate. Make sure those two are checked.