Many security certificates at the last Ubuntu update

[RoGeorge]

Never seen this before, is it normal at an update?

Code: [Select]

Processing triggers for ca-certificates (20230311ubuntu0.22.04.1) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...

done.
Updating Mono key store
Mono Certificate Store Sync - version 6.8.0.105
Populate Mono certificate store from a concatenated list of certificates.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2008 Novell. BSD licensed.

Importing into legacy system store:
I already trust 124, your new list has 137
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R1
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R2
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R3
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R4
Certificate added: C=HK, S=Hong Kong, L=Hong Kong, O=Hongkong Post, CN=Hongkong Post Root CA 3
Certificate added: C=US, O=Microsoft Corporation, CN=Microsoft ECC Root Certificate Authority 2017
Certificate added: C=US, O=Microsoft Corporation, CN=Microsoft RSA Root Certificate Authority 2017
Certificate added: C=KR, O=NAVER BUSINESS PLATFORM Corp., CN=NAVER Global Root Certification Authority
Certificate added: C=US, S=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global Certification Authority
Certificate added: C=US, S=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global ECC P256 Certification Authority
Certificate added: C=US, S=Illinois, L=Chicago, O="Trustwave Holdings, Inc.", CN=Trustwave Global ECC P384 Certification Authority
Certificate added: C=CN, O=UniTrust, CN=UCA Extended Validation Root
Certificate added: C=CN, O=UniTrust, CN=UCA Global G2 Root
Certificate added: C=RO, O=CERTSIGN SA, OU=certSIGN ROOT CA G2
Certificate added: C=HU, L=Budapest, O=Microsec Ltd., OID.2.5.4.97=VATHU-23584497, CN=e-Szigno Root CA 2017
Certificate added: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign ECC Root CA - C3
Certificate added: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
Certificate added: C=US, OU=emSign PKI, O=eMudhra Inc, CN=emSign Root CA - C1
Certificate added: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign Root CA - G1
Certificate added: C=ES, O=FNMT-RCM, OU=Ceres, OID.2.5.4.97=VATES-Q2826004J, CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS
Certificate added: SERIALNUMBER=G63287510, C=ES, O=ANF Autoridad de Certificacion, OU=ANF CA Raiz, CN=ANF Secure Server Root CA
Certificate added: C=PL, O=Asseco Data Systems S.A., OU=Certum Certification Authority, CN=Certum EC-384 CA
Certificate added: C=PL, O=Asseco Data Systems S.A., OU=Certum Certification Authority, CN=Certum Trusted Root CA
Certificate added: C=AT, O=e-commerce monitoring GmbH, CN=GLOBALTRUST 2020
Certificate added: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Root E46
Certificate added: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Root R46
Certificate added: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
Certificate added: C=US, O=Certainly, CN=Certainly Root E1
Certificate added: C=US, O=Certainly, CN=Certainly Root R1
Certificate added: C=DE, O=D-Trust GmbH, CN=D-TRUST BR Root CA 1 2020
Certificate added: C=DE, O=D-Trust GmbH, CN=D-TRUST EV Root CA 1 2020
Certificate added: C=US, O="DigiCert, Inc.", CN=DigiCert TLS ECC P384 Root G5
Certificate added: C=US, O="DigiCert, Inc.", CN=DigiCert TLS RSA4096 Root G5
Certificate added: C=TR, L=Ankara, O=E-Tugra EBG A.S., OU=E-Tugra Trust Center, CN=E-Tugra Global Root CA ECC v3
Certificate added: C=TR, L=Ankara, O=E-Tugra EBG A.S., OU=E-Tugra Trust Center, CN=E-Tugra Global Root CA RSA v3
Certificate added: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS ECC Root CA 2021
Certificate added: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS RSA Root CA 2021
Certificate added: C=TW, O="Chunghwa Telecom Co., Ltd.", CN=HiPKI Root CA - G1
Certificate added: C=US, O=Internet Security Research Group, CN=ISRG Root X2
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication ECC RootCA1
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication RootCA3
Certificate added: C=FI, O=Telia Finland Oyj, CN=Telia Root CA v2
Certificate added: C=TN, O=Agence Nationale de Certification Electronique, CN=TunTrust Root CA
Certificate added: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus ECC Root CA
Certificate added: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus Root CA
45 new root certificates were added to your trust store.
Import process completed.

Importing into BTLS system store:
I already trust 124, your new list has 137
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R1
Certificate added: C=US, O=Google Trust Services LLC, CN=GTS Root R2
Certificate added: C=ES, CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
Certificate added: C=US, O=Certainly, CN=Certainly Root R1
Certificate added: C=DE, O=D-Trust GmbH, CN=D-TRUST BR Root CA 1 2020
Certificate added: C=DE, O=D-Trust GmbH, CN=D-TRUST EV Root CA 1 2020
Certificate added: C=US, O="DigiCert, Inc.", CN=DigiCert TLS ECC P384 Root G5
Certificate added: C=US, O="DigiCert, Inc.", CN=DigiCert TLS RSA4096 Root G5
Certificate added: C=TR, L=Ankara, O=E-Tugra EBG A.S., OU=E-Tugra Trust Center, CN=E-Tugra Global Root CA ECC v3
Certificate added: C=TR, L=Ankara, O=E-Tugra EBG A.S., OU=E-Tugra Trust Center, CN=E-Tugra Global Root CA RSA v3
Certificate added: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS ECC Root CA 2021
Certificate added: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS RSA Root CA 2021
Certificate added: C=TW, O="Chunghwa Telecom Co., Ltd.", CN=HiPKI Root CA - G1
Certificate added: C=US, O=Internet Security Research Group, CN=ISRG Root X2
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication ECC RootCA1
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", CN=Security Communication RootCA3
Certificate added: C=FI, O=Telia Finland Oyj, CN=Telia Root CA v2
Certificate added: C=TN, O=Agence Nationale de Certification Electronique, CN=TunTrust Root CA
Certificate added: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus ECC Root CA
Certificate added: C=CN, O="iTrusChina Co.,Ltd.", CN=vTrus Root CA
20 new root certificates were added to your trust store.
Import process completed.
Done
done.

[tatel]

Shuttleworth --Ubuntu's owner-- made his money selling cheap (Thawte) security certifications IIRC. So perhaps Ubuntu is providing you more root certificates out of the box than other distros? Or perhaps it's just coming down the stream from Debian.

I wouldn't worry much about it --provided fingerprint of the download coincides with the one published in the repository. It looks as if your system already trusted 124 root certificates and the list is now 137 root certificates

[ataradov]

Here is a reference to the update https://ubuntu.com/security/notices/USN-6105-1 . It looks like a lot of stuff was just outdated and this update cleans it up.

[RoGeorge]

Thank you, I've searched before asking here, and no significant result popped in the first pages.