I also have a problem with Debian method of compiling a list of CAs.
ca-certificates package rolls in Java and Mongo CAs as well as Mozilla.
Their tools to do that is also not very clear on how they are put together the ca-certs either from 32 different subdirectories.
A (ahem) short write up that also includes suggestion of improvements. Debian bug has been filed but the Debian maintainer does not seem to be interested in moving this along.
ca-certificates package rolls in Java and Mongo CAs as well as Mozilla.
Their tools to do that is also not very clear on how they are put together the ca-certs either from 32 different subdirectories.
A (ahem) short write up that also includes suggestion of improvements. Debian bug has been filed but the Debian maintainer does not seem to be interested in moving this along.
https://egbert.net/blog/articles/ca-certificates-rebuild-on-...