title: CA Cert are only added at ca-bundle-trust.crt
body: <p>Env:</p>
  
  <pre><code>Red Hat Enterprise Linux Server release 7.7 (Maipo)
  # openssl version
  OpenSSL 1.0.2g  1 Mar 2016
  </code></pre>
  
  <p>so a self-sign cert is generated using OpenSSL and the cacert.pem is put under <code>/etc/pki/ca-trust/source/anchors/</code>.</p>
  
  <p>Now according to the man from <code>update-ca-trust</code>, the cmd should be run to add the cert into the trust store and the cert are to be added under <code>/etc/pki/ca-trust/extracted/</code>.</p>
  
  <p>After running the said cmd, I see that the cert is added only to <code>/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt</code>. But most of the application like curl refer the OS ca trust at <code>/etc/pki/ca-trust/extracted/openssl/ca-bundle.crt</code> which is link to <code>/etc/pki/tls/certs/ca-bundle.crt</code>.</p>
  
  <pre><code>curl -v https://172.21.19.92/api
  * About to connect() to 172.21.19.92 port 443 (#0)
  *   Trying 172.21.19.92...
  * Connected to 172.21.19.92 (172.21.19.92) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  </code></pre>
  
  <p>I understand that passing <code>--cacert</code> option would be a way to overcome it but I want to know why <code>update-ca-trust</code> only update <code>ca-bundle-trust.crt</code> and not <code>ca-bundle.crt</code> or the java Keystore extracted one as well <code>/etc/pki/ca-trust/extracted/java/cacerts</code></p>