Use --insecure to download ca-certificates source where necessary

Library/Homebrew/download_strategy.rb

@@ -544,6 +544,8 @@ def _curl_args
 
     args += [meta[:header], meta[:headers]].flatten.compact.flat_map { |h| ["--header", h.strip] }
 
+    args += ["--insecure"] if meta[:insecure]
+
     args
   end
 

Library/Homebrew/resource.rb

@@ -42,6 +42,10 @@ def initialize(name = nil, &block)
   def owner=(owner)
     @owner = owner
     patches.each { |p| p.owner = owner }
+
+    return if !owner.is_a?(SoftwareSpec) || owner.full_name != "ca-certificates"
+
+    @specs[:insecure] = !DevelopmentTools.ca_file_handles_most_https_certificates?
   end
 
   def downloader
@@ -170,10 +174,14 @@ def sha256(val)
   def url(val = nil, **specs)
     return @url if val.nil?
 
+    specs = specs.dup
+    # Don't allow this to be set.
+    specs.delete(:insecure)
+
     @url = val
-    @specs.merge!(specs)
-    @using = @specs.delete(:using)
+    @using = specs.delete(:using)
     @download_strategy = DownloadStrategyDetector.detect(url, using)
+    @specs.merge!(specs)
     @downloader = nil
   end