I tested with openssl s_client and the new set of root CAs and sites that fail in microb work in openssl so that suggests its microb-engine or nss failing somewhere.