Curl 60 error when updating system

[anemarkus]

The default crypto policy is DEFAULT (otherwise it would be quite a misname?)
About the repository certificates in the context of crytpo policies there was a thread not so long ago - here is the link

CURL certificate error on apstream

Hey @iztokd - Glad you were able to figure this out for your system. With respect to 2048-bit keys on the mirrors - this will not be changing any time soon. 4096-bit keys are computationally very expensive, and furthermore provide little security gain for something like a TLS web certificate which is already rotated automatically every ~90 days. On the backend connections, we are either using 4096-bit RSA or ECDSA keys, however these are long-lived connections between our CDN and origin, and t…