Cannot verify certificate in Centos?

Question

IMAP

Since August 2018, any upgraded server on Centos 6.10 or Centos 7 cannot access sites with some certificates, because there is no trust in the certificate authority that issued the certificate.
For example:

wget https://imap.yandex.ru:993
--2018-08-04 20:30:46--  https://imap.yandex.ru:993/
Resolving imap.yandex.ru... 87.250.251.124, 213.180.204.124, 93.158.134.124, ...
Connecting to imap.yandex.ru|87.250.251.124|:993... connected.
ERROR: cannot verify imap.yandex.ru’s certificate, issued by “/C=RU/O=Yandex LLC/OU=Yandex Certification Authority/CN=Yandex CA”:
  Unable to locally verify the issuer’s authority.
To connect to imap.yandex.ru insecurely, use ‘--no-check-certificate’.

Legs grow from php c imap:

imap_open(): Couldn't open stream {imap.yandex.ru:993/imap/ssl}INBOX in file.php on line 31
PHP Notice:  Unknown: Certificate failure for imap.yandex.ru: unable to get local issuer certificate: /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Trusted Network CA (errflg=2)

And 99% of other resources work correctly.
Systems updated, ca-certificates.noarch too:

Version     : 2018.2.22
Release     : 65.1.el6
Size        : 2.6 M
Repo        : installed

The effect can be repeated on a fresh virtual machine with Centos 6 or Centos 7 with all updates.
CHADNT?

Answer 1

What's incomprehensible? Even the publisher has already been traced, the idea was actually correct. View the issuer of the certificate, find the issuer's certificate, and place it in the trusted certificate store. This happens, and often - a certificate is issued at a CA, the certificate of which is not in the trusted ones, despite the fact that it is, for example, Komodo. Komodo has many subCAs and not all of their certificates are distributed. You need to manually find the certificate of this subCA /

Answer 2

CityCat4 , lehha , the same problem with Yandex arose :( Did you manage to solve the problem somehow? Which certificate is missing?

Answer 3

If anyone is interested, I found a way to get around this situation. Instead
imap.yandex.ru:993/imap/ssl
of writing in imap_open()
imap.yandex.ru:993/imap/ssl/novalidate-cert