vim /etc/ca-certificates.conf
comment line mozilla/DST_Root_CA_X3.crt

update-ca-certificates -f -v
Clearing symlinks in /etc/ssl/certs…
done.
Updating certificates in /etc/ssl/certs…
Doing .
150 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d…
done.

This will update update /etc/ssl/certs on Debian 9