dpkg --listfiles ca-certificates

Well looks like they should take the hint from a better vendor such as Debian then :)