You should periodically download a copy of certdata.txt and run the make-ca.sh script
You need perl, gawk and wget packages installed to run the 'make-ca.sh' script

wget https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt

make-ca.sh