I found lots of cool stuff around altering the debconf database to have the questions in the UI preseeded, but it didn't actually change anything for me.

Ultimately, what got it working for me was to figure out what dpkg-reconfigure is likely doing and then just do it myself (via script). It wasn't actually that much.

1. Copy your .crt certs to /usr/share/ca-certificates/your.domain.tld

   
   



2. Symlink these certs you added to /usr/share/ca-certificates/your.domain.tld in to /etc/ssl/certificates/

   
   



3. Make sure /etc/ca-certificates.conf contain a line for your certs like:

   
   

   your.domain.tld/issuing_ca.crt
   
   your.domain.tld/root_ca.crt
   
   

   
   

   Notice that those lines do NOT start with !, that would deselect these certs. For this step, I used:

   
   
   
   

   • sed -i ... to make sure these lines had no leading !

     
     
   
   

   • bash conditional to check if these lines even existed, e.g.:

     
     

     if [ ! grep -q "your.domain.tld/issuing_ca.crt" /etc/ca-certificates.conf ] ; then
     
     

     
     
   
   

   • if the lines didn't exist, I added them with:

     
     

     cat [filename] >> /etc/ca-certificates.conf
     
     

     
     
   
   
   
   



4. Run sudo update-ca-certificates.

   
   

   (This combines all the certs in /etc/ssl/certs to make a single ca-certificates.crt that applications use.)