http://bugs.winehq.org/show_bug.cgi?id=17842
--- Comment #11 from cbxbiker61@gmail.com 2011-02-14 19:22:09 CST --- I forgot to mention that you "should" create hash links in the /etc/ssl/certs directory to the new .pem files. PopCap will still validate without them. But it's possible in the future that Wine won't ignore non-authoritive errors. As it is now, Wine pretty much ignores when certs are self-signed.
Here's a script that will create the symlink hashes that OpenSsl uses to determine whether certs are signed. Run it against the new certs in /etc/ssl/certs as root.
#! /bin/bash
set -e
cert="$1" hash=$(openssl x509 -hash -noout -in $cert)
ln -s "$cert" "$hash.0"