[jontro]

For mysql at least you need to specify what CA or cert to trust. There is no default CA which mysql will try to use. So once a CA expires you will have to rotate it