When I run
package-list-packages, I'm getting an error:
The TLS connection to elpa.gnu.org:443 is insecure for the following reason:
certificate could not be verified
I found a few other reports of this, but all seemed to be due to some local mis-configuration (like this one). I ruled this out by recompiling the latest version of Emacs from the emacs-26 branch, and launching with
emacs -Q (that's Emacs 26.0.91). The problem still persists.
Another clue: this only happens on my desktop running Ubuntu 14.04, not on my laptop running Debian testing. So I suspect it may be due to something important being outdated on the ancient version of Ubuntu I'm saddled with (and cannot update, it's a work computer).
How can I resolve this, or at least find the source of the problem?