Often ignored by many package managers, languages, and apps but worth doing anyway. The following works in debian/ubuntu based containers. The finalized store is accessible afterwards at /etc/ssl/certs/ca-certificates.crt which can be referenced below.
USER root
RUN mkdir /usr/local/share/ca-certificates/extra
COPY certs/*.crt /usr/local/share/ca-certificates/extra/