Hi, I can confirm this issue on a freshly installed Debian 13 system, installed via netboot/preseed using an HTTPS mirror. The installer used bootstrap-base 1.226.
Despite ca-certificates being updated to 20250419+deb13u1, I found 150 certificates in /usr/local/share/ca-certificates, including Comodo_AAA_Services_root.crt and emSign_ECC_Root_CA_-_G3.crt. Both are marked as disabled in /etc/ca-certificates.conf, but their local copies remain trusted. Running update-ca-certificates --fresh does not resolve this, as it picks up those copies again. I verified that bootstrap-base.postinst copies the installer's /etc/ssl/certs/*.crt into /target/usr/local/share/ca-certificates when using HTTPS. A comparison installation using a netinst CD, with ca-certificates installed after first boot, has an empty local certificate directory and does not exhibit the problem. This has a significant security impact: an up-to-date system can continue trusting certificates explicitly removed by a security update. Thanks, -- Jonathan Leroy Relkian – https://relkian.com
