to get your own CA (easily created with tinyca) into your debian/ubuntu system as an accepted CA do this:
actually it seems, the update-ca-certificates script accepts only files named .crt .. so place your .pem there named .crt ..
:# cp your-ca.crt /usr/local/share/ca-certificates :# update-ca-certificates
voila, it is now imported
you can check what the above script actually did with:
:# ls -al /etc/ssl/certs/ | grep your-ca