3

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file:

/etc/ssl/certs/ca-certificates.crt

get updated when I upgrade my system using: apt-get upgrade?

I have a program that uses OpenSSL and validates servers' certs using the CA certs in this path. I need to know if I can assume that my file has an updated CAs list if I upgraded using apt-get upgrade.

Improve this question

1 Answer 1

Reset to default
4

The global trust store in /etc/ssl/certs/ is part of the ca-certificates package and receives regular updates as can be seen from this Changelog. These are normal updates which get installed by apt-get upgrade.

The specific file itself is not part of the package but is generated by update-ca-certificates. This command gets automatically called on updates of ca-certificates as needed to reflect the changes in the trust store.

Improve this answer
2
  • Thanks for your clarification. So the bottom line is, with apt-get upgrade, the file /etc/ssl/certs/ca-certificates.crt gets updated. Right?
    – user9371654
    Commented Dec 9, 2018 at 18:00
  • @user9371654: correct.
    – Steffen Ullrich
    Commented Dec 9, 2018 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .