"Fixed" by solving bug 1149131. Reading the man page it seems the cert-sync tool is indeed supposed to be called just once during installation (so it's following Microsoft documentation now). A real fix however would involve: * Changing the path of Mono's certificate store to a writable location * Calling cert-sync (as an update-ca-certificates plugin) on boot / whenever certificates have been changed