Index: usr.sbin/freebsd-update/freebsd-update.sh
===================================================================
--- usr.sbin/freebsd-update/freebsd-update.sh
+++ usr.sbin/freebsd-update/freebsd-update.sh
@@ -2944,6 +2944,13 @@
 		install_from_index INDEX-NEW || return 1
 		install_delete INDEX-OLD INDEX-NEW || return 1
 
+		# Any cert changes?
+		if grep -qE -m 1 -e '^/usr/share/certs/(trusted|blacklisted)' \
+		    $1/INDEX-OLD $1/INDEX-NEW; then
+			# Rehash if we've modified installed certs
+			env DESTDIR=${BASEDIR} certctl rehash
+		fi
+
 		# Rebuild generated pwd files.
 		if [ ${BASEDIR}/etc/master.passwd -nt ${BASEDIR}/etc/spwd.db ] ||
 		    [ ${BASEDIR}/etc/master.passwd -nt ${BASEDIR}/etc/pwd.db ] ||