`sslrootcert=system` is broken, requires installing `ca-certificates` package

Since Postgres 16, the sslrootcert=system connection parameter turns on sslmode=verify-full and instructs psql to use the system CA cert store. This is a lot more secure than sslmode=require and works very nicely for people with Postgres providers who use public CAs to secure their databases.

Unfortunately, sslrootcert=system currently doesn't work on the psql binaries shipped in these Docker images:

# psql 'postgresql://user:pass@ep-broad-dew-xyz.us-east-2.aws.neon.tech/neondb?sslrootcert=system'
psql: error: connection to server at "ep-broad-dew-xyz.us-east-2.aws.neon.tech" (3.x.x.x), port 5432 failed: SSL error: certificate verify failed

Fortunately, the fix is simple: apt-get update && apt-get install ca-certificates does the trick. It's also simple to test the fix using a free-tier Neon DB.

Would you be able to update all images from 16.x up to come with the ca-certificates package installed, to make this work?

I'm maintaining a list of psql distributions that do and don't work here: https://gist.github.com/jawj/57bc9d1f350ffd5250942cf24957b3a7

Start by inspecting the Docker image definitions for PostgreSQL 16.x and reproduce the reported psql connection against a free-tier Neon database. Update the relevant image definitions so ca-certificates is installed, then verify that sslrootcert=system succeeds for the affected images.