Question: ```
CentOS Linux release 7.6.1810 (Core)
Kernel 5.1.11-1.el7.elrepo.x86_64

```

I put a cert-file to `/etc/pki/ca-trust/source/anchors`

File looks like that:

```
-----BEGIN CERTIFICATE-----
MIIDojCCAoqgAwIBAgIQeqkpty5ghoxP8YfCRe+7qjANBgkqhkiG9w0BAQUFADBP
some strings
FnpKVwAq6UcYOu4AoXweaqOOMsLNSw==
-----END CERTIFICATE-----

```

And after `update-ca-trust extract` I expect to see my cert in the bundle-file `/etc/pki/tls/certs/ca-bundle.crt` but there was nothing new in it. And `ls -al` show me latest edit time, so It was changed 2 monts ago, not now.

Initially I try this with `.crt` file. But renaming `.crt` to `.pem` didn't solve my problem.
I also tried `update-ca-trust enable` and `update-ca-trust force-enable` before extract, but it didn't help.
`/var/log/messages` says nothing about that.

What I shell do to fix it?

Answer: 
**TL;DR**

The `update-ca-trust` won't extract your certificate file to the `ca-bundle.crt` unless this succeeds:

```
openssl x509 -noout -text -in <cert_file> | grep --after-context=2 "X509v3 Basic Constraints" | grep "CA:TRUE"

```

---

I spent a few hours on this issue. Its root was in a X.509 extension called [Basic Constraints](https://en.wikipedia.org/wiki/X.509#Extensions_informing_a_specific_usage_of_a_certificate) which is used to mark whether a certificate belongs to a CA or not.

My humble findings:

1. The `update-ca-bundle` tool is in fact a shell script, so it's easy to peek inside
2. The script calls `p11-kit` utility multiple times each time using different filter and creating different bundle files.
3. The file `ca-bundle.crt` is in fact a link from `tls-ca-bundle.pem` file which is generated by `p11-kit` using `ca-anchors` filter. So it ignores all certs besides "CA ones".
4. If a certificate is or is not a CA is decided by *Basic Constraints* X.509 extension. This way it's possible to mark a certificate as a part of a CA.
5. It's possible to list all X.509 extensions using `openssl x509 -noout -text -in <cert_file>`
6. So any certificate file not labelled as a part of a CA will be filtered out by `p11-kit` and not exported to the desired `ca-bundle.crt` file.

Feel free to correct this in comments.
The CA certifications should be in place on the system within the ca-trust bundle. The "openssl x509" command is expecting to operate against a single PEM encoded certificate at a time. Since the underlying bundle has many certificates included, only the first is displayed.

To show all issuers:

```
openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs | grep subject | head

```