Arch isn’t unstable, I just keep breaking things in my ignorance. The only thing in this scenario I could pin on Arch is that the “ca-certificates” package should have been marked as a dependency for pacman, but I guess it’s not strictly a dependency, as you can use pacman to install stuff from a local repo. Definitely for Firefox, though, as you can not browse the internet without the certs.