BTW, about that: dpkg -l 'ca-certificates' | grep ^ii
There. ^ is a special characters in several shells including rc, es, zsh -o extendglob and older versions of fish (and the Bourne shell, but it's unlikely anyone would use that on Ubuntu). Better as dpkg -l ca-certificates | grep '^ii' Also, as noted above, that might also affect mono trusted CA certificates (I've not tested as I don't use mono). It's risky to apply the work-arounds listed above on a production system. rm -f /etc/ssl/certs/java/cacerts && update-ca-certificate --fresh Should not be done if there's a chance /etc/ssl/certs/java/cacerts may contain certificates other than the ones copied copied from /etc/ssl/certs/ca-certificates.crt by update-ca-certificates, or they'd be lost. keytool -list -cacerts -storepass changeit | sed -n 's/^\(debian:[^,]*\),.*/-\1/p' | sudo /etc/ca-certificates/update.d/jks-keystore && update-ca-certificate --fresh Like the previous one would leave a window during which there is no trusted CA for java. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2061817 Title: [regression][security] ca-certificates.postinst does not feed adds/removes to hooks To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2061817/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
