Heya, haven't tested it yet on PS3 but I recently found ZeroSSL, the alternative to LetsEncrypt which seems to be nearly as old. So the CA *should* be in the PS3 Firmware.
Maybe its worth a try? :)
https ://zerossl. com/
Regarding the PSX convertion. I did all the Steps and even tested around a bit but I can't get past Step 11.
Drag it on the rifgen_edatresign from ps3xploit resigner and resign it
Whenever I drag the EBOOT.PBP on ps3xploit_rifgen_edatresign.exe from the latest release it just says that no...