To export trusted certificates from truststore and import them into truststore.new, perform the following steps for each trusted certificate:

  1. Locate the currently trusted certificates. 
    manage-certificates list-certificates \
  --keystore truststore
  2. For each alias other than server-cert, or whose fingerprint does not match server-cert, perform the following steps:
    1. Export the trusted certificate from truststore. 
      manage-certificates export-certificate \
  --keystore truststore \
  --keystore-password-file truststore.pin \
  --alias <trusted-cert-alias> \
  --export-certificate-chain \
  --output-file trusted-cert-alias.crt
    2. Import the trusted certificate into truststore.new. 
      manage-certificates import-certificate \
  --keystore truststore.new \
  --keystore-type JKS \
  --keystore-password-file truststore.pin \
  --alias <trusted-cert-alias> \
  --certificate-file trusted-cert-alias.crt