Question: ```
CentOS Linux release 7.6.1810 (Core)
Kernel 5.1.11-1.el7.elrepo.x86_64

```

I put a cert-file to `/etc/pki/ca-trust/source/anchors`

File looks like that:

```
-----BEGIN CERTIFICATE-----
MIIDojCCAoqgAwIBAgIQeqkpty5ghoxP8YfCRe+7qjANBgkqhkiG9w0BAQUFADBP
some strings
FnpKVwAq6UcYOu4AoXweaqOOMsLNSw==
-----END CERTIFICATE-----

```

And after `update-ca-trust extract` I expect to see my cert in the bundle-file `/etc/pki/tls/certs/ca-bundle.crt` but there was nothing new in it. And `ls -al` show me latest edit time, so It was changed 2 monts ago, not now.

Initially I try this with `.crt` file. But renaming `.crt` to `.pem` didn't solve my problem.
I also tried `update-ca-trust enable` and `update-ca-trust force-enable` before extract, but it didn't help.
`/var/log/messages` says nothing about that.

What I shell do to fix it?

Answer: 
I don't know exactly what you are asking but the steps below work for me. I enable 'ca trust', copy over the file, extract, and then verify.

```
$ update-ca-trust enable
$ cp ZScalar.pem /etc/pki/ca-trust/source/anchors/
cp: overwrite ‘/etc/pki/ca-trust/source/anchors/ZScalar.pem’? yes
$ update-ca-trust extract
$ openssl verify  ZScalar.crt
ZScalar.crt: OK

```

If these steps don't work please post the output of the "openssl verify" command and I might be able to direct you further.

To add to this, extracted certs go to "/etc/pki/ca-trust/extracted/openssl" or "/etc/pki/ca-trust/extracted/pem".
In my case it was just because i was not using `sudo`

Copy the CA certificate to `/etc/pki/ca-trust/source/anchors`, then call below command

```
sudo update-ca-trust extract

```

After this check the exit code, should be 0

```
echo $?

```

OR grep CA certificate name in below file for confirmation

```
cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep "CA-cert-name"

```