Comment # 2 on bug 1124059 from Bruno Friedmann

Hi Markus : you're right the defective cert are no more belonging to any
packages

I've located them all at the same place
ll /etc/pki/trust/*.pem
-rw-r--r-- 1 root root 1691 mai 25  2016
/etc/pki/trust/AddTrustExternalCARoot.pem
-rw-r--r-- 1 root root 1456 mai 25  2016 /etc/pki/trust/aol1.pem
-rw-r--r-- 1 root root 2151 mai 25  2016 /etc/pki/trust/aol2.pem
-rw-r--r-- 1 root root 1549 mai 25  2016 /etc/pki/trust/aoltw1.pem
-rw-r--r-- 1 root root 2244 mai 25  2016 /etc/pki/trust/aoltw2.pem
-rw-r--r-- 1 root root 2565 mai 25  2016 /etc/pki/trust/argena.pem
-rw-r--r-- 1 root root 1505 mai 25  2016 /etc/pki/trust/argeng.pem
-rw-r--r-- 1 root root 1533 mai 25  2016 /etc/pki/trust/eng1.pem
-rw-r--r-- 1 root root 1533 mai 25  2016 /etc/pki/trust/eng2.pem
-rw-r--r-- 1 root root 2228 mai 25  2016 /etc/pki/trust/eng3.pem
-rw-r--r-- 1 root root 1533 mai 25  2016 /etc/pki/trust/eng4.pem
-rw-r--r-- 1 root root 1549 mai 25  2016 /etc/pki/trust/eng5.pem
-rw-r--r-- 1 root root 1295 mai 25  2016 /etc/pki/trust/Equifax-root1.pem
-rw-r--r-- 1 root root 1842 mai 25  2016 /etc/pki/trust/ICP-Brasil.pem
-rw-r--r-- 1 root root 1911 mai 25  2016 /etc/pki/trust/PositiveSSLCA2.pem
-rw-r--r-- 1 root root 1343 mai 25  2016 /etc/pki/trust/RegTP-5R.pem
-rw-r--r-- 1 root root 1343 mai 25  2016 /etc/pki/trust/RegTP-6R.pem
-rw-r--r-- 1 root root 1269 mai 25  2016 /etc/pki/trust/thawteCb.pem
-rw-r--r-- 1 root root 1297 mai 25  2016 /etc/pki/trust/thawteCp.pem
-rw-r--r-- 1 root root 1122 mai 25  2016 /etc/pki/trust/vsign1.pem
-rw-r--r-- 1 root root 1122 mai 25  2016 /etc/pki/trust/vsign3.pem
-rw-r--r-- 1 root root 1116 mai 25  2016 /etc/pki/trust/vsignss.pem
-rw-r--r-- 1 root root 1553 mai 25  2016 /etc/pki/trust/wellsfgo.pem

I've not been able to find from where and why there's still there.
As I've check similar installation (Leap upgrade from 13->42->15) and none of
them have those I've simply drop them. most are invalid or will soon be
expired.

Sorry for the noise.