I had similar issue. I've tried to install the most recent ca-certificates*.rpm manually. No success. Having no other idea how to manage the situation, I decided to implement very ugly and brutal workaround. Namely, I have added temporarily 'sslverify=0' to '/etc/dnf/dnf.conf'. I'm still looking for the solution that addresses the real root cause.