[BUG]
Run Fatdog64-901's /usr/bin/update-ca-certificates, a symbolic link to a shell-script file called /usr/libexec/p11-kit/trust-extract-compat, and nothing happens because the script is just a placeholder.
[FIX]
Please use Fatdog64-812's /usr/libexec/p11-kit/trust-extract-compat instead.