Why does gnupg create 4 separate keys and what does sub and ssb mean? When using gpg to create a single key, I get:

$  gpg --list-keys
-------------------------------
pub   2048R/0C0EA301 2018-01-01
uid       [ultimate] 
sub   2048R/023A0509 2018-01-01


$ gpg --list-secret-keys
-------------------------------
sec   2048R/0C0EA301 2018-01-01
uid                  
ssb   2048R/023A0509 2018-01-01


When using bouncycastle to view the keys (in ~/.gnupg/pubring.gpg and ~/.gnupg/secring.gpg), I find that there are four keys created:

(#gpg.public[9AB238A08EF3EAB0A7D01E1284AB64C10C0EA301] 
 #gpg.public[A841D2BA6635154081F3A5176DE7FF9B023A0509])

(#gpg.secret[9AB238A08EF3EAB0A7D01E1284AB64C10C0EA301] 
 #gpg.secret[A841D2BA6635154081F3A5176DE7FF9B023A0509])


Why does gpg create four keys (public/private/sub/ssb) and what are they for?
The abbreviations stand for the following: 


pub -- public primary key
sub -- public sub-key
sec -- secret primary key
ssb -- secret sub-key


In asymmetric cryptography you always have key pairs: A public key to encrypt, a private (secret) key to decrypt. Here we have two key pairs: (1, 3) and (2, 4). They can be identified by their identical fingerprints. 

But why are there two key-pairs? When generating an OpenPGP key with GnuPG, per default a primary key (pair), also called master-key, and a sub-key (pair) are created. The primary key, also called master-key, contains one or more user-IDs (name, email-address) and is used for for signing. The sub-key, signed by the primary key and thus confirmed to belong to its user-IDs, is used for encryption/decryption. 

The idea for having a master-key with sub-keys is very well described here. If you want to deviate from the default behaviour and gain more control about the key generation, e.g. create only a single key-pair or select a certain cryptographic algorithm, you should try gpg --full-gen-key (introduced in GnuPG 2.1.17).