# This is the first, problematic certificate
C1=pkcs11:id=%54%5A%CB%26%3F%71%CC%94%46%0D%96%53%EA%6B%48%D0%93%FE%42%75;type=cert
  # OU=ApplicationCA,O=Japanese Government,C=JP
  # label: Japanese Government
trust list --filter=$C1

# This is the second, reference certificate
C2=pkcs11:id=%56%A7%AC%AA%02%1D%B2%AC%3D%90%0E%A0%6F%2E%41%C6%76%E7%7B%DA;type=cert
  # CN=ApplicationCA2 Root,OU=GPKI,O=Japanese Government,C=JP
  # label: ApplicationCA2 Root
trust list --filter=$C2

# This is the default output with regards to them
trust extract --format=openssl-directory --filter=certificates default
ls -l --time-style=+- default | grep -E '(Japanese|ApplicationCA)' | tee default.list
# 10e86c82.0 and cd47d6af.0 point to ApplicationCA2_Root.pem: OK
# 57bbd831.0 and fac084d7.0 point to Japanese_Government.pem: OK

# Distrusting the first certificate gets it renamed
trust extract --filter=$C1 --format=x509-file /etc/pki/ca-trust/source/blocklist/JapaneseGovernment.crt
trust extract --format=openssl-directory --filter=certificates block1
ls -l --time-style=+- block1 | grep -E '(Japanese|ApplicationCA)' | tee block1.list
# 10e86c82.0 and cd47d6af.0 point to ApplicationCA2_Root.pem
# 57bbd831.0 and fac084d7.0 point to ApplicationCA.pem  <--- this is unexpected
diff -U0 default.list block1.list && exit 5

trust extract --filter=$C2 --format=x509-file /etc/pki/ca-trust/source/blocklist/JapaneseGovernment.crt
trust extract --format=openssl-directory --filter=certificates block2
ls -l --time-style=+- block2 | grep -E '(Japanese|ApplicationCA)' | tee block2.list
# 57bbd831.0 and fac084d7.0 point to Japanese_Government.pem: OK
# 10e86c82.0 and cd47d6af.0 point to ApplicationCA2_Root.pem <-- no change
diff -U0 default.list block2.list && exit 9