I found this today, very handy link that explains how to regenerate the CA’s.
https://access.redhat.com/solutions/1549003
This didn’t actually resolve my error because my customer had a CAFile that had cert, but the CAPath was empty.. I’ve seen weird NSS -8172 errors before like this.
I’ll update this post once I figure out what it actually is causing it.