/etc/pam_pkcs11/cacerts/ is in libpam-pkcs11 0.6.9-2build2.
This file is owned by root:root, with mode 0o755.