Bug#976465: Restore rejection of expired trusted (root) certificate

[Matthias Klose]

Package: src:openssl
Version: 1.1.1h-1
Severity: serious
Tags: sid bullseye patch

Please backport https://github.com/openssl/openssl/pull/13585

Without this patch, this causes python-asyncssh's tests to fail (and failing the
build).