Thank you for the hint. Last time I needed to do this I wrote a script which basically does the same without being that versatile.

It helped to understand more about local cert storage (e.g. cert9.db) etc. but I prefer using a tool like this which is maintained by the community and probably still works some years from now.