c:\>bin\certutil.exe -H -A
-A Add a certificate to the database (create if needed)
-n cert-name Specify the nickname of the certificate to add
-t trustargs Set the certificate trust attributes:
trustargs is of the form x,y,z where x is for SSL, y is for S/MIME,
and z is for code signing. Use ,, for no explicit trust.
p prohibited (explicitly distrusted)
P trusted peer
c valid CA
T trusted CA to issue client certs (implies c)
C trusted CA to issue server certs (implies c)
u user cert
w send warning
g make step-up cert
-f pwfile Specify the password file
-d certdir Cert database directory (default is ~/.netscape)
-P dbprefix Cert & Key database prefix
-a The input certificate is encoded in ASCII (RFC1113)
-i input Specify the certificate file (default is stdin)
https://github.com/christian-korneck/firefox_add-certs/blob/master/add-certs.cmd#L24 and two other lines have a comma at the end
-t "cTC,cTC,cTC",