The main problem is getting new certificates, because the ones bundled in the OS have expired. It took a lot of searching to find something that worked and I'm not sure if it was one "solution", or the result of multiple "solutions" being tried out.

The secondary problem is new software won't run properly, like corporate/commercial VPN clients. It took a lot of fiddling to get Tunnelblick to work with a commercial VPN, and I couldn't get some corporate client to work, even using an old version.