/usr/bin/cert-sync is in ca-certificates-mono 4.6.2.7+dfsg-1.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2
#!/bin/sh exec /usr/bin/mono $MONO_OPTIONS /usr/lib/mono/4.5/cert-sync.exe "$@"