That doesn't help since the root certificates aren't connected to those 3 .db files.

At this point I am now convinced that something in some of the new root certificates (new PKCS#11 extention, new algorithm, new flags, something removed or whatever) is not supported by the NSS/security code we have in the current microb-engine codebase. How we can update NSS (and make any necessary changes elsewhere in the microb-engine code to support new things like newer TLS versions and stuff) is something I am playing with although I haven't figured it out yet.