Tcl 9 removed the "binary" encoding alias, so setting it fails and the channel
keeps the system encoding. A CA file with non-ASCII bytes then comes back
corrupted under any system encoding other than iso8859-1. Read it with
-translation binary, which Tcl 8.6 and 9 both accept, and stop if that fails.

diff -ruN A/generic/tls.c B/generic/tls.c
--- A/generic/tls.c
+++ B/generic/tls.c
@@ -1908,7 +1908,10 @@
     if (in == NULL) {
 	goto cleanup;
     }
-    Tcl_SetChannelOption(interp, in, "-encoding", "binary");
+    if (Tcl_SetChannelOption(interp, in, "-translation", "binary") != TCL_OK) {
+	Tcl_Close(interp, in);
+	goto cleanup;
+    }
     buf = Tcl_NewObj();
     Tcl_IncrRefCount(buf);

CA files loaded from a VFS fail under a non-Latin-1 locale on Tcl 9 because -encoding binary is no longer valid.