diff --git a/usr.sbin/certctl/certctl.sh b/usr.sbin/certctl/certctl.sh
--- a/usr.sbin/certctl/certctl.sh
+++ b/usr.sbin/certctl/certctl.sh
@@ -68,7 +68,7 @@
 	     -name '*.pem' -or \
 	     -name '*.crt' -or \
 	     -name '*.cer' \
-	\) 2>/dev/null
+	\) -a -not -name ca-root-nss.crt 2>/dev/null
 }
 
 eolcvt()