Arch Linux

Description:
After the upgrade of nss & p11-kit, flatpak applications cannot use the system certificates, resulting in no connectivity to any HTTPS service.

Downgrading the following packages works around the problem:
p11-kit (0.23.19-1 => 0.23.18.1-2)
ca-certificates-utils (20181109-3 => 20181109-2)
ca-certificates-mozilla (3.49.2-1 => 3.49.1-1)
nss (3.49.2-1 => 3.49.1-1)

Flatpak certs are linked from /usr/share/ca-certifcates/mozilla
while the system certs are from /etc/ca-certificates/extracted/cadir

Downgrading only ca-certificates-utils and ca-certificates-mozilla does not fix the problem.

Additional info:
* package version(s)
core/ca-certificates-mozilla 3.49.2-1
core/ca-certificates-utils 20181109-3
core/nss 3.49.2-1
core/p11-kit 0.23.19-1

* config and/or log files etc.
flatpak run --deve --comand=bash com.skype.Client # executes bash in the sandbox
gnutls-cli google.com # results in certificate error


* link to upstream bug report, if any
Should be a packaging bug


Steps to reproduce:
Try to use the flatpak version of Slack, Skype or Spotify. Any other flatpak app that relies on systemwide certificates would fail as well