Thank you!!! I've been unable to play anything and had no idea how to work around this issue. Your workaround worked.

Oh, the joys of Rawhide... Does Rawhide have a mailing list to be alerted to issues like this? I haven't been able to launch Steam for a while now. Thank you for the workaround. :heart:

Does Rawhide have a mailing list to be alerted to issues like this?

You'll find in the mentioned change proposal 2 announcements on devel-announce, as well as a thread on Fedora Discussions. It would also help to be familiar with docs.fp.o; your question is easily answered via the site-wide search.

ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pem seems to fix it.

Just experienced this issue after upgrading from Fedora 42 to Fedora 44 (Prerelease).

Can confirm that running update-ca-trust extract --rhbz2387674 allowed my steam to launch!

Confirming that update-ca-trust extract --rhbz2387674 also works on Fedora 44 Rawhide.

Description of problem:

• I was able to launch the steam application, however, after choosing my profile and being sent to the login screen, the QR code (off to the right) would become "stuck" showing the loading animation.
• I was able to enter my username and password, but after clicking login, the button would get stuck show the loading animation as well.

Troubleshooting:
I only came across this issue and solution after launching steam from terminal, and seeing the SSL error message in the log. I.e. src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates.

Note: Per this issue, I had also tried sudo dnf reinstall ca-certificates, but that did not fix the problem.

This change will not be going away in fedora, so we need to fix this in steam, I am not aware of the inner working there but if someone from steam will take a look I can provide assistance.

For the record, the workaround even gives a warning:

 sudo update-ca-trust extract --rhbz2387674
[sudo] password for hakimi: 
----------------------------------------------------------------------------
** DEPRECATION WARNING **
----------------------------------------------------------------------------
The option --rhbz2387674 is a temporary workaround and will be removed in a
future release. Please do not use it in build scripts or automation.

----------------------------------------------------------------------------
** ACTION REQUIRED **
----------------------------------------------------------------------------
To ensure the affected package works correctly in the future, a bug report 
must
be filed.

1.  Check if a bug already exists for the affected package: 
https://bugzilla.redhat.com/buglist.cgi?component=ca-certificates&product=Fe
dora&short_desc=droppingOfCertPemFile%20package%3A&short_desc_type=allwordss
ubstr

2.  If no bug exists, please file a new one using this template: 
https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=ca-certif
icates&version=rawhide&short_desc=droppingOfCertPemFile+package:+<<package_n
ame>>+is+affected

Thank you for helping improve Fedora.

Currently on Fedora 44 KDE Beta (fresh install).

Steam installed via Discover (RPM Fusion package) and I launched it both from desktop application menu or steam command on terminal. Steam fails during bootstrap with:

unable to load trusted SSL root certificates

Running the workaround sudo update-ca-trust extract --rhbz2387674 allows Steam to start successfully.

Same issue for me on F44 Beta.

Steam fails with unable to load trusted SSL root certificates
Totally worth fixing because https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile is not going away.
And Fedora is one of the most used distributions, and Linux users are widely using it for gaming. This issue is only going to grow even bigger with F44 release scheduled for April 2026...

FYI, various components of Steam itself depend on these pathnames:

$ find ~/.local/share/Steam -type f -exec strings {} + | grep -E '/etc/(pki|ssl)/' | sort | uniq -c | sort -n
      1 steamrt64/pv-runtime/steam-runtime-steamrt/steamrt3c_platform_3c.0.20260119.200242/files/etc/ssl/certs/ca-certificates.crt,201927;1768792768;4202215492
      1 steamrt64/pv-runtime/steam-runtime-steamrt/steamrt3c_platform_3c.0.20260119.200242/files/etc/ssl/openssl.cnf,11118;1759488880;3711083170
      2 TLS_CACERT	/etc/ssl/certs/ca-certificates.crt
      3 ETCCERTSDIR=/etc/ssl/certs
      3 # in /etc/ssl/certs to the certificate file and its inclusion into the
      3 # installed in /etc/ssl/certs.
      3 # update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
      4 /etc/pki/tls/certs/ca-bundle.crt
      7 /etc/pki/tls/cert.pem
      7 /etc/ssl/ca-bundle.pem
     23 /etc/ssl/certs
     33 /etc/ssl/certs/ca-certificates.crt

and the same for whatever Steam games I have installed currently:

$ find /srv/SteamLibrary/ -size -10M -type f -exec strings {} + | grep -E '/etc/(pki|ssl)/' | sort | uniq -c | sort -n
      3 /etc/ssl/
      4 ETCCERTSDIR=/etc/ssl/certs
      4 /etc/ssl/certs/
     12 /etc/pki/tls/certs/ca-bundle.crt
     22 /etc/ssl/certs/ca-certificates.crt
     30 /etc/ssl/certs

IMO removing these very commonly-used symlinks is going to break a lot of 3rd party software, much (most?) of which will never be rebuilt to depend on the proper pathnames. I note that there is not one instance of the proper /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem path being used. I think better documentation needs to be written clearly pointing developers at this path because they are clearly all overlooking it. And removing the one pathname that is common between the Fedora and Debian universes (/etc/ssl/certs/ca-certificates.crt) is going to make things difficult for developers of 3rd party software...

For the record, this has been hack-fixed in RPM Fusion - but it takes a pretty long time for Steam to open because the certificates need to be restored in the background using the above workaround and users might believe it's not working. Not only that but the option this relies on will be gone at some point so this still requires a proper fix.

IMO removing these very commonly-used symlinks is going to break a lot of 3rd party software, much (most?) of which will never be rebuilt to depend on the proper pathnames. I note that there is not one instance of the proper /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem path being used. I think better documentation needs to be written clearly pointing developers at this path because they are clearly all overlooking it. And removing the one pathname that is common between the Fedora and Debian universes (/etc/ssl/certs/ca-certificates.crt) is going to make things difficult for developers of 3rd party software...

Thanks for your insights.
I will have to verify but it might be possible to at least bring back the /etc/ssl/... structure.
As for the documentation the reasons that /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem is not really used yet is probably due to this change being pretty recent, and even so using library defaults is preferred so that we don't have to go trough this ever again. Still I will see what can be done to improve the visibility. If you have any place where you would expect it mentioned, just let me know, I will try to put it there.

Update: as stated in the previous update I have restored the /etc/ssl/... structure.
rawhide build: https://bodhi.fedoraproject.org/updates/FEDORA-2026-285c6d38f7.
f44 will follow once the freeze is lifted: https://bodhi.fedoraproject.org/updates/FEDORA-2026-285c6d38f7
This seems to fix the steam issue.
@yrro thanks for pointing this out!

ca-certificates-2025.2.80_v9.0.304-7.fc44.noarch works like a charm - thank you @FrantisekKrenzelok :)