I was reading about adding new root CA certificates. I have figured that out but I wanted to know how already existing certificates get updated? Do they get updated over network every time the machine starts or do we have to manually update it? If so, How?
ca-certificates package is the usual way to update the root CA certificates in Linux. The package contains Mozilla's root CA certificate list as well as any the distro packagers add.