How to populate /etc/ssl/certs

Hello.

I've searched for this, but I didn't find an answer.

How is /etc/ssl/certs populated?

Does "make installworld" create the links for certificates in 
/usr/share/certs/trusted?
Or should etcupdate?

What about /usr/local/share/certs/?
I see on some of my machines a link to 
/usr/local/share/certs/ca-root-nss.crt: the latter is installed by 
security/ca_root_nss, but it doesn't seem to be the port that creates 
the link...

Also, I'm using ezjail and older jails have /etc/ssl/certs empty!
Newer jails' /etc/ssl/certs is almost identical to base's, although some 
certs are missing (I suspect it was correctly created, but doesn't get 
updated).

  bye & Thanks
	av.