Regenerated the certificates here again, 10 years at 1024 bit. The issue with [7b80198969] seems to have been that I extended the Root cert validity to 100 years, and that screwed something up. With the root certs now back to 10 years (+10 days) validity, things are fine. I suspect that I may have run into the Y2038 problem in either Tcl and/or openssl.