Question: ```
CentOS Linux release 7.6.1810 (Core)
Kernel 5.1.11-1.el7.elrepo.x86_64

```

I put a cert-file to `/etc/pki/ca-trust/source/anchors`

File looks like that:

```
-----BEGIN CERTIFICATE-----
MIIDojCCAoqgAwIBAgIQeqkpty5ghoxP8YfCRe+7qjANBgkqhkiG9w0BAQUFADBP
some strings
FnpKVwAq6UcYOu4AoXweaqOOMsLNSw==
-----END CERTIFICATE-----

```

And after `update-ca-trust extract` I expect to see my cert in the bundle-file `/etc/pki/tls/certs/ca-bundle.crt` but there was nothing new in it. And `ls -al` show me latest edit time, so It was changed 2 monts ago, not now.

Initially I try this with `.crt` file. But renaming `.crt` to `.pem` didn't solve my problem.
I also tried `update-ca-trust enable` and `update-ca-trust force-enable` before extract, but it didn't help.
`/var/log/messages` says nothing about that.

What I shell do to fix it?

Answer: 
I don't know exactly what you are asking but the steps below work for me. I enable 'ca trust', copy over the file, extract, and then verify.

```
$ update-ca-trust enable
$ cp ZScalar.pem /etc/pki/ca-trust/source/anchors/
cp: overwrite ‘/etc/pki/ca-trust/source/anchors/ZScalar.pem’? yes
$ update-ca-trust extract
$ openssl verify  ZScalar.crt
ZScalar.crt: OK

```

If these steps don't work please post the output of the "openssl verify" command and I might be able to direct you further.

To add to this, extracted certs go to "/etc/pki/ca-trust/extracted/openssl" or "/etc/pki/ca-trust/extracted/pem".
The CA certifications should be in place on the system within the ca-trust bundle. The "openssl x509" command is expecting to operate against a single PEM encoded certificate at a time. Since the underlying bundle has many certificates included, only the first is displayed.

To show all issuers:

```
openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs | grep subject | head

```