Does Ubuntu have an authoritative finite list of TLS certificate trust backends used by applications

knana6

I am trying to understand Ubuntu's TLS certificate trust architecture at a general level.

By “trust backend” I mean the mechanism or certificate store an application uses to decide whether a server TLS certificate chains to a trusted CA.

I have encountered several mechanisms on Ubuntu, including:

• the Ubuntu system CA store (/etc/ssl/certs, ca-certificates)
• NSS certificate databases
• Firefox/Mozilla profile or policy-based certificate handling
• p11-kit / PKCS#11 trust
• Java cacerts / Java KeyStores
• application-bundled or private/custom CA stores

I am not assuming that these are six completely independent backend technologies; some may overlap or be management/isolation layers around another backend.

My questions are:

1. Does Ubuntu define a finite, authoritative number of TLS certificate trust backends?
2. Is the list above exhaustive, or can applications use additional/custom trust mechanisms?
3. Should Snap and Flatpak be counted as separate trust backends, or are they isolation environments that can contain private instances of an existing backend such as NSS?
4. Is Mozilla/Firefox technically a separate backend, or mainly an NSS-based store with Mozilla-specific profile/policy management?

I am especially interested in answers backed by Ubuntu documentation, upstream documentation, or source code.