This directory /etc/ca-certificates/extracted/ contains CA certificate bundle
files which are automatically created based on the information found in the
/usr/share/ca-certificates/trust-source/ and /etc/ca-certificates/trust-source/
directories.

The files are as follows:

  - ca-bundle.trust.crt:

    This file is in the BEGIN/END TRUSTED CERTIFICATE file format, 
    as described in the x509(1) manual page.

  - edk2-cacerts.bin:

    This file is in the EDK2 (EFI Development Kit II) file format.

  - email-ca-bundle.pem, objsign-ca-bundle.pem, tls-ca-bundle.pem:

    All files are in the BEGIN/END CERTIFICATE file format, 
    as described in the x509(1) manual page.

    Distrust information cannot be represented in this file format,
    and distrusted certificates are missing from these files.

If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
then you can use these files in your application to load a list of global
root CA certificates.

Please never manually edit the files stored in this directory,
because your changes will be lost and the files automatically overwritten,
each time the update-ca-trust command gets executed.

Please refer to the update-ca-trust(8) manual page for additional information.
