/usr/share/igtf-policy/classic/CESNET-CA-3.pem is in igtf-policy-classic 1.59-1.
This file is owned by root:root, with mode 0o777.
It is a symlink to /usr/share/igtf-policy/classic/../../ca-certificates/igtf-classic/CESNET-CA-3.crt