Hi
I’m a bit puzzled, over night some web radio channels generates Certificate error on RPI ver 2.9XX (Tested 2.907, 2.909 and 2.912) but works fine on ver 3.094!
This is because a ca-certificate expired today, an anouncement and fix are underway.
Okay , thanks for the info
Basically, an old root certificate (DST Root CA X3) from Let’s Encrypt expired yesterday, and required that clients use their newer root certificate (ISRG Root X1). To make the transition easier, they have cross signed certs with both root certificates. But older versions of openssl don’t like this, and will complain as you see.
As put eloquently by the Let’s Encrypt team:
Thankfully, the version of openssl shipped with Buster has all these fixes…
The team is working hard, and hopefully we have a stable Buster release soon! 
We released an update that fixes the issue. Just update to the latest version and everything will be fine