List Ubuntu’s trusted CA certificates

Ubuntu's system CA bundle is normally /etc/ssl/certs/ca-certificates.crt, a PEM file containing the enabled CA certificates. List their subjects and issuers with:

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout

This shows the certificates in that bundle. It does not establish that every application on the machine uses the same trust store.

Inspect individual certificates

# Show a sample of the directory entries.
ls /etc/ssl/certs/ | head -20

# Inspect one installed certificate, if present.
openssl x509 -in /etc/ssl/certs/ISRG_Root_X1.pem -noout -text | less

# Show its validity dates.
openssl x509 -in /etc/ssl/certs/ISRG_Root_X1.pem -noout -dates

The directory includes individual certificate links and hash-based links used by OpenSSL-style directory lookup. The bundle is the concatenated representation. Do not count every directory entry as a separate trusted CA: multiple links can refer to the same certificate.

Compare the server's actual chain

If the local trust store has an expected root but a connection still fails, check what the server sends:

openssl s_client -showcerts -connect example.com:443 \
  -servername example.com -verify_hostname example.com \
  -verify_return_error </dev/null

The displayed certificate list is the chain sent by the server, not necessarily the chain the client ultimately builds. A missing intermediate may need to be added to the server's full-chain configuration. A root normally does not need to be sent by the server; trust comes from the client's trust store.

Add or remove a local CA

Only install a CA whose origin and intended authority you have verified. For an approved internal CA, use one PEM certificate per file with a .crt suffix:

sudo cp my-ca.crt /usr/local/share/ca-certificates/my-ca.crt
sudo update-ca-certificates

To remove that locally installed CA:

sudo rm /usr/local/share/ca-certificates/my-ca.crt
sudo update-ca-certificates --fresh

Distribution-provided selections are controlled through /etc/ca-certificates.conf. The Ubuntu update-ca-certificates manual describes how the bundle and links are generated. Reinstalling the ca-certificates package can repair missing package files; it does not replace the need to review custom trust configuration.

Common questions

Which programs use the bundle versus the directory?

That depends on each TLS library and application's configuration. OpenSSL consumers may use CAfile, a hashed CApath, or both. Do not assume a Java application reads /etc/ssl/certs/ as an OpenSSL directory.

Why does Java reject a CA that Ubuntu trusts?

Java commonly uses a Java truststore such as cacerts, or an explicitly configured application truststore. Some Ubuntu packages synchronize system CA changes into Java trust through hooks, but custom JDKs and containers may differ. Inspect the running JVM's actual truststore before importing an approved CA with keytool.

What package maintains the system CA list?

The package is ca-certificates. sudo apt install --reinstall ca-certificates restores its packaged files; run the normal trust-store update workflow and confirm the intended certificates afterward.