I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file:


get updated when I upgrade my system using: apt-get upgrade?

I have a program that uses OpenSSL and validates servers' certs using the CA certs in this path. I need to know if I can assume that my file has an updated CAs list if I upgraded using apt-get upgrade.


The global trust store in /etc/ssl/certs/ is part of the ca-certificates package and receives regular updates as can be seen from this Changelog. These are normal updates which get installed by apt-get upgrade.

The specific file itself is not part of the package but is generated by update-ca-certificates. This command gets automatically called on updates of ca-certificates as needed to reflect the changes in the trust store.

  • Thanks for your clarification. So the bottom line is, with apt-get upgrade, the file /etc/ssl/certs/ca-certificates.crt gets updated. Right? – user9371654 Dec 9 '18 at 18:00
  • @user9371654: correct. – Steffen Ullrich Dec 9 '18 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.