I wanted a way to log into Gentoo Bugzilla with Chromium using CACert SSL certificates without needing to click through the red screen of hate.

First we need dev-libs/nss with USE="utils".

Next as your normal user;

wget http://www.cacert.org/certs/root.crt
wget http://www.cacert.org/certs/class3.crt

certutil -d sql:$HOME/.pki/nssdb -A -t "TCu,Cu,Tuw" -n \
"CACert Class 1 Root Certificate" -i root.crt
certutil -d sql:$HOME/.pki/nssdb -A -t "TCu,Cu,Tuw" -n \
"CACert Class 3 Root Certificate" -i class3.crt
rm root.crt class3.crt

Thats it ...