cacert: really fix utf-8 certname blacklists

See #27576.

pkgs/data/misc/cacert/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, writeText, nss, python3
+{ stdenv, fetchurl, writeText, nss, python
 , blacklist ? []
 , includeEmail ? false
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = nss.src;
 
-  nativeBuildInputs = [ python3 ];
+  nativeBuildInputs = [ python ];
 
   configurePhase = ''
     ln -s nss/lib/ckfw/builtins/certdata.txt
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
     ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
     EOF
 
-    cp ${certdata2pem} certdata2pem.py
+    cat ${certdata2pem} > certdata2pem.py
+    patch -p1 < ${./fix-unicode-ca-names.patch}
     ${optionalString includeEmail ''
       # Disable CAs used for mail signing
       substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] '''