The db_unprotect/db_protect_pop calls have been added in the wrong spot. Without this fossil tls-config remove-exception example.org fails due to the authorizer (as expected).

Index: src/http_ssl.c
==================================================================
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -586,18 +586,16 @@
     Blob sql;
     char *zSep = "(";
     db_begin_transaction();
     blob_init(&sql, 0, 0);
     if( g.argc==4 && find_option("all",0,0)!=0 ){
-      db_unprotect(PROTECT_CONFIG);
       blob_append_sql(&sql,
         "DELETE FROM global_config WHERE name GLOB 'cert:*';\n"
         "DELETE FROM global_config WHERE name GLOB 'trusted:*';\n"
         "DELETE FROM config WHERE name GLOB 'cert:*';\n"
         "DELETE FROM config WHERE name GLOB 'trusted:*';\n"
       );
-      db_protect_pop();
     }else{
       if( g.argc<4 ){
         usage("remove-exception DOMAIN-NAME ...");
       }
       blob_append_sql(&sql,"DELETE FROM global_config WHERE name IN ");
@@ -614,11 +612,13 @@
            zSep/*safe-for-%s*/, g.argv[i], g.argv[i]);
         zSep = ",";
       }
       blob_append_sql(&sql,");");
     }
+    db_unprotect(PROTECT_CONFIG);
     db_exec_sql(blob_str(&sql));
+    db_protect_pop();
     db_commit_transaction();
     blob_reset(&sql);
   }else
   /*default*/{
     fossil_fatal("unknown sub-command \"%s\".\nshould be one of:"