It seems, that there are plenty of surprises connected with using external references in Eclipse.

One such surprise is that after half an hour of update process and accepting permanently the server certificate you get to accept the server certificate again and again (permanently).

What might seem confusing is actually pretty simple:

With externals there are many repositories and many certificates. Checking out a project with externals will cause the client to talk to Servers, which are not in your repository list, thus you will need to accept those certificates…

So now, that is not a bug, just choose “accept permanently”