to get your own CA (easily created with tinyca) into your debian/ubuntu system as an accepted CA do this:

actually it seems, the update-ca-certificates script accepts only files named .crt .. so place your .pem there named .crt .. :D

:# cp your-ca.crt /usr/local/share/ca-certificates
:# update-ca-certificates

voila, it is now imported :)

you can check what the above script actually did with:

:# ls -al /etc/ssl/certs/ | grep your-ca