diff --git a/mingw-w64-ca-certificates/PKGBUILD b/mingw-w64-ca-certificates/PKGBUILD
index e956fced7f..8ae849f861 100644
--- a/mingw-w64-ca-certificates/PKGBUILD
+++ b/mingw-w64-ca-certificates/PKGBUILD
@@ -3,7 +3,7 @@
 _realname=ca-certificates
 pkgbase=mingw-w64-${_realname}
 pkgname="${MINGW_PACKAGE_PREFIX}-${_realname}"
-pkgver=20210119
+pkgver=20211016
 pkgrel=1
 pkgdesc='Common CA certificates (mingw-w64)'
 arch=('any')
@@ -15,19 +15,17 @@ source=("https://ftp.debian.org/debian/pool/main/c/${_realname}/${_realname}_${p
         'certdata2pem.py'
         'certdata2pem.patch'
         'update-ca-trust'
-        'update-ca-trust.8'
-        'blacklist-dst-root-ca-x3.patch')
+        'update-ca-trust.8')
 depends=("${MINGW_PACKAGE_PREFIX}-p11-kit")
 makedepends=("${MINGW_PACKAGE_PREFIX}-openssl"
              "${MINGW_PACKAGE_PREFIX}-p11-kit"
              "${MINGW_PACKAGE_PREFIX}-python"
              'asciidoc' 'libxslt' 'sed' 'grep')
-sha256sums=('daa3afae563711c30a0586ddae4336e8e3974c2b627faaca404c4e0141b64665'
+sha256sums=('2ae9b6dc5f40c25d6d7fe55e07b54f12a8967d1955d3b7b2f42ee46266eeef88'
             '9508738b61cc89bfc1f42580b1091a650f0acbf5c1b49edc2aa4e0313276ea0d'
             '5736cc3a73ff9bceed43bafad85100a2fcfdfae1cf2cb7e201b5fa6f1421fc2e'
-            '65fc13d01550be7f89046a62605d6203eb68dba7edf5dbb04a2068b4f7cd2e65'
-            'b052972dd118a3e25f785b6caa141599f0db6fc1d943e9ebcd6ca0e1f0421f60'
-            'ded49e7b1a79f61ac02531b308a0a8cf96ca7476e669af5c29ec6e9d19b25e23')
+            'ad9fd7ba5c304521128a0a15f3c3ccd79480d9414de08c93bca8bbb7a942f1b0'
+            'b052972dd118a3e25f785b6caa141599f0db6fc1d943e9ebcd6ca0e1f0421f60')
 
 prepare() {
   cd "${srcdir}"
@@ -39,7 +37,6 @@ prepare() {
   cd ${srcdir}/${_realname}-${pkgver}
   cp ${srcdir}/update-ca-trust sbin/
   cp ${srcdir}/update-ca-trust.8 sbin/
-  patch -p1 -i ${srcdir}/blacklist-dst-root-ca-x3.patch
 }
 
 build() {
diff --git a/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch b/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch
deleted file mode 100644
index 50198964d6..0000000000
--- a/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch
+++ /dev/null
@@ -1,7 +0,0 @@
---- a/mozilla/blacklist.txt       2021-01-19 11:11:04.000000000 +0100
-+++ b/mozilla/blacklist.txt       2021-10-02 11:14:46.449980400 +0200
-@@ -7,3 +7,4 @@
- "MITM subCA 2 issued by Trustwave"
- "TURKTRUST Mis-issued Intermediate CA 1"
- "TURKTRUST Mis-issued Intermediate CA 2"
-+"DST Root CA X3"
diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANG32.install b/mingw-w64-ca-certificates/ca-certificates-CLANG32.install
index bb0a02d9c1..c647620c00 100644
--- a/mingw-w64-ca-certificates/ca-certificates-CLANG32.install
+++ b/mingw-w64-ca-certificates/ca-certificates-CLANG32.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANG64.install b/mingw-w64-ca-certificates/ca-certificates-CLANG64.install
index 1c2ae3cc5d..7cd6f6bc84 100644
--- a/mingw-w64-ca-certificates/ca-certificates-CLANG64.install
+++ b/mingw-w64-ca-certificates/ca-certificates-CLANG64.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install b/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install
index eef522a02c..4606e33edb 100644
--- a/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install
+++ b/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/ca-certificates-MINGW32.install b/mingw-w64-ca-certificates/ca-certificates-MINGW32.install
index 667e963d7d..7260690d4a 100644
--- a/mingw-w64-ca-certificates/ca-certificates-MINGW32.install
+++ b/mingw-w64-ca-certificates/ca-certificates-MINGW32.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/ca-certificates-MINGW64.install b/mingw-w64-ca-certificates/ca-certificates-MINGW64.install
index f236ce0b93..c7cd703fe9 100644
--- a/mingw-w64-ca-certificates/ca-certificates-MINGW64.install
+++ b/mingw-w64-ca-certificates/ca-certificates-MINGW64.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/ca-certificates-UCRT64.install b/mingw-w64-ca-certificates/ca-certificates-UCRT64.install
index 6f2acee515..a9ddae74f0 100644
--- a/mingw-w64-ca-certificates/ca-certificates-UCRT64.install
+++ b/mingw-w64-ca-certificates/ca-certificates-UCRT64.install
@@ -6,11 +6,11 @@ post_install() {
 
   # OpenSSL PEM bundle that includes trust flags
   # (BEGIN TRUSTED CERTIFICATE)
-  ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-  ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+  ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
 
   mkdir -p ${_mingw_prefix}/ssl/certs
   cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt
diff --git a/mingw-w64-ca-certificates/update-ca-trust b/mingw-w64-ca-certificates/update-ca-trust
index 1a38da1a71..11d3a8e01a 100644
--- a/mingw-w64-ca-certificates/update-ca-trust
+++ b/mingw-w64-ca-certificates/update-ca-trust
@@ -11,8 +11,8 @@ DEST=@PREFIX@/etc/pki/ca-trust/extracted
 
 # OpenSSL PEM bundle that includes trust flags
 # (BEGIN TRUSTED CERTIFICATE)
-@PREFIX@/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
-@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
-@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
-@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
-@PREFIX@/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
+@PREFIX@/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
+@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
+@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+@PREFIX@/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts