Comment by contingencies

I've had since Debian 8 (2015) few helper scripts to make me remember better how to manage approved CA's. There are three of those, which have been working all Debian versions since 8 to current 13.

# cat /usr/local/sbin/ca-certificates-list-active

  #!/usr/bin/env bash
  #
  # BFMI tool to list Debian CA certificates active  - mesrik, 2015
  #
  
  CA_CONFIG=/etc/ca-certificates.conf
  CA_REPO_DEBIAN=/usr/share/ca-certificates
  
  if [ -f $CA_CONFIG ]; then
      # study any ca-certificates which have been configured active
      for i in $(egrep -v '^[#!]' /etc/ca-certificates.conf) ; do
         cert_source=$(dirname $i)
         cert_file=$(basename $i)
         openssl x509 -in $CA_REPO_DEBIAN/$cert_source/$cert_file -noout -subject |\
           sed 's/^subject=//'
      done
  
  else
      echo "$(basename $0): Ooops, was not able to access $CA_CONFIG"
  fi
  
  # eof
  

# cat /usr/local/sbin/ca-certificates-reconfigure

  #!/usr/bin/env bash
  LANG=C dpkg-reconfigure ca-certificates

# cat /usr/local/sbin/ca-certificates-invalidate-all

  #!/usr/bin/env bash
  #
  # BFMI tool to invalidate all CA certificates in Debian Jessie - mesrik, 2015
  #
  
  CA_CONFIG=/etc/ca-certificates.conf
  prog=$(basename $0)
  usage="Usage: $prog  { -commit }"
  
  if [ $# -lt 1 ]; then
      echo $usage
      exit 1
  fi
  
  if [ "$1" = "-commit" ]; then
      if [ -f $CA_CONFIG ]; then
         backup_ext=$(date -r $CA_CONFIG +".%FT%T%z")
         perl -wpi$backup_ext -e 's/^([^!#].*)$/!$1/;' $CA_CONFIG
         if [ $? -eq 0 ]; then
            echo "$prog: backup $CA_CONFIG$backup_ext was made."
            /usr/sbin/update-ca-certificates
         fi
      else
         echo "$prog: Ooops, was not able to access $CA_CONFIG"
      fi
  else
      echo "$prog: Need -commit to actually invalidate all CA's"
  fi
  
  # eof

ps. I did bit of editing, I didn't expect Tab to be ignored when pasting here.