Looks like the source for the ca-certificates package from debian contains python script to convert mozilla certificates file to the format we need (certdata2pem.py) so that should make things easier.

The last commit from anyone Nokia (the Nov 27 2011 commit) matches the Mozilla NSS certificates file as of mozilla-central changeset 2432457fa32b

Does anyone know where the filenames for the certificates (e.g. 00d85a4c25c122e58b31ef6dbaf3cc5f29f10d61-1.pem) come from? What is that string of numbers?