mbedtls: Re-allow SHA1-signed certificates