Turns out CIS compliance breaks a lot of things. If you get 'CA certificate key too weak' errors on RHEL/Fedora, try 'sudo update-crypto-policies --set DEFAULT'