In some N9 update or refresh thread I posted links how to do it manually and I also made a deb for updating the certs. I am no N9 expert and this aegis stopped me using the N950, but what I can say with my deb the internal browser and also the opera mobile browser got new certificates. For the deb I made some version number increase, but it could be that some packages depend on this with a fixed version number, so it would be better to change the version number to the pr1.3 number again. But then you can't see the update by a version number.
However I think so far there were no complains, but also don't know if somebody tried the deb.
It could also be that my N950 behave different due to some hacks. For example I tried to install Opera mobile from openrepos with the gui and it was not possible, so I needed to use the commandline and it was working.

Will look if I could find my post about certificates.