What are .pki and nssdb folders for?

I’ve got some SELinux denials as on pdf creation, invoiceplane had not enough permissions for .pki and nssdb.

Invoiceplane (php-fpm) is configured to run as invoiceplane a linux (system)user, invoiceplane’s home is another path as /var/www/public/invoiceplane.

I’ve set selinux to permisse to see what’s happening there. It creates the folders .pki/nssdb inside the home folder. But they are empty, even though I’ve refreshed the generated pdf a couple of times. So it looks like, invoiceplane has just created these folders but not using them. What are they for?

I am not entirely sure but this seems to be related to mPDF (PDF engine) loading assets over a https-secured URL as the folder seems to belong to certificates.