I can confirm that on amd64 at least the newest version is ~deb12u2
Could differ on other platforms, thus to see when yours was installed:
2026-10-21 06:07:34 status installed ca-certificates:all 20250419~deb12u2
For some reason, you don’t seem to have the bookworm-security repository, which is the one that updated ca-certificates to the latest version
If I’m not mistaken, you should be able to add it with:
echo "deb http://deb.debian.org/debian-security/ bookworm-security main contrib non-free non-free-firmware" | sudo tee -a /etc/apt/sources.list
Then try sudo apt update and apt-cache policy ca-certificates it should show the latest version, and you should be able to upgrade.
If that works, you can check curl https://dv-g3b-emudhra.we-have-a-problem.com/ again
cat /etc/apt/sources.list /etc/apt/sources.list.d/*
# deb cdrom:[Debian GNU/Linux 11.4.0 _Bullseye_ - Official amd64 NETINST 20220709-10:31]/ bookworm main
#deb cdrom:[Debian GNU/Linux 11.4.0 _Bullseye_ - Official amd64 NETINST 20220709-10:31]/ bookworm main
deb https://deb.debian.org/debian/ bookworm main non-free non-free-firmware contrib
deb-src https://deb.debian.org/debian/ bookworm main non-free non-free-firmware contrib
# Line commented out by installer because it failed to verify:
#deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
# Line commented out by installer because it failed to verify:
#deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
# bookworm-updates, to get updates before a point release is made;
# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports
deb https://deb.debian.org/debian/ bookworm-updates main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian/ bookworm-updates main contrib non-free non-free-firmware
# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.
deb [signed-by=/etc/apt/trusted.gpg.d/extra_php_version.gpg] https://packages.sury.org/php/ bookworm main
deb [signed-by=/etc/apt/trusted.gpg.d/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main
deb [signed-by=/usr/share/keyrings/yunohost-bookworm.gpg] http://forge.yunohost.org/debian/ bookworm stable
I eventually got a new round of updates today that included both ca-certificates 20250419~deb12u2 and php 8.5.12, now everything’s all good. Thanks everyone!
Good to know that it’s solved 
You should still add that repository I think.
Try uncommenting (just remove the #) both debian-security bookworm lines and do apt update if the update reports a signature error you can try installing debian-archive-keyring with apt install debian-archive-keyring
@Pinipon @tmb : thanks for the guidance, indeed the dpkg log grep returned nothing in my case.
I did an apt-get update as I was writing this message and the package arrived.
Could it be that it lands first in bookworm-security (very quickly) and then gets propagated in the main repos later on? That would explain why it only arrived later in my case…
Ia there a way from the dpkg log to see which repo the package came from?
I was suspecting a missing repo in my case, this is potentially a big problem for me for a secure public production installation of YNH. Is the diagnosis able to point that out?
Thanks again for all the help!
Nice, makes sense that security is updated first, maybe some apt log could tell.
@NathanU has the same problem (but apparently “installer disabled”).
That fixed it; thank you