apt-cacher-ng and CNAMEs

[Celejar <celejar@gmail.com>]

I'm trying to use the Tor upstream repositories:

https://support.torproject.org/apt/tor-deb-repo/

Direct access works correctly, but proxying through apt-cacher-ng
(using SSL passthrough, as per the apt-cacher-ng documentation) does
not:

Err:1 https://deb.torproject.org/torproject.org sid InRelease
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: xx.xx.xx.xx 3142]

I've been beating my head over this for a while, and I have arrived at
the tentative conclusion that the problem has something to do with the
fact that deb.torproject.org is a CNAME alias for
static.torproject.org., and I'm consequently somehow getting bitten by
this issue:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986356

But that (as described by the maintainer) mess was supposedly resolved,
and the bug was closed. Am I missing something, or does that bug need
to be reopened?

-- 
Celejar