Truststore shipped with Openfire already shows 5 invalid CAs. So it probably needs updating again (last one was in August 2016). This should probably become a regular task (cloned for next version).
It appears ubuntu-trusty still shows `20160104ubuntu0.14.04.1` as the latest version
Then maybe we can just remove invalid ones?
My ubuntu trusty now shows `Version: 20170717~14.04.1`, so will try an update this again as per what was done previously