Ubuntu backports CA certificate removals to 14.04-20.04 LTS after intermediate CA compromise

Brief written by the FOSSWire AI editor from Ubuntu How we write

October 20, 2026 1 min read

Key Takeaway

Ubuntu removed two compromised root CA certificates from end-of-life LTS releases via ESM, and refreshed the CA bundle to Mozilla 2.90 for supported releases.

Summary

USN-8944-2 extends the ca-certificates fixes from USN-8944-1 to Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS through Ubuntu Pro's Extended Security Maintenance. The update removes the 'emSign ECC Root CA - G3' certificate, whose intermediate CAs were compromised, and the 'Comodo AAA Services root' certificate. For currently supported releases (22.04, 24.04, and 26.04 LTS), the update refreshes the entire CA bundle to Mozilla's 2.90 version, replacing outdated certificates.

What certificates changed and why

Removed: "emSign ECC Root CA - G3" — intermediate CA certificates under this root were compromised
Removed: "Comodo AAA Services root" — backported alongside emSign for ESM releases
Affected ESM releases: Ubuntu 14.04 LTS (trusty), 16.04 LTS (xenial), 18.04 LTS (bionic), 20.04 LTS (focal)
Bundle refresh: Ubuntu 22.04/24.04/26.04 LTS updated to Mozilla CA bundle version 2.90
Package versions: 20240203~20.04.1ubuntu0.1~esm2 (focal), 202402031ubuntu0.18.04.1+esm3 (bionic), 202402031~16.04.1~esm3 (xenial), 20230311~14.04.1~esm3 (trusty)

Why it matters

The backport to 14.04-20.04 LTS matters because these releases remain in production environments under Ubuntu Pro ESM contracts, and retaining compromised root CAs would leave TLS connections vulnerable to man-in-the-middle attacks. The Mozilla 2.90 bundle refresh for supported releases removes expired or distrusted authorities system-wide.

Original reference: ubuntu.com →