There is another way to clear out unneeded trusted root certs that we had to do that required connecting the ldap database using an ldap browser that I'm not sure there is even a kb for, that was a problem we had that was breaking upgrades and other things.