certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <certificate nickname> \
-i <certificate filename>
E.g.,
certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n "bb.localhost" \
-i /usr/local/share/ca-certificates/wildcard.bb.localhost.crt
certutil -d sql:$HOME/.pki/nssdb -L
View certificates in Chrome: chrome://settings/?search=manage+certificates