# Ubuntu releases ca-certificates update to fix JKS keystore synchronization

> **Key takeaway:** A bug in the ca-certificates JKS integration prevented the removal of revoked or deleted CA certificates from Java Keystores, which is now resolved via a resync update.

**Published:** 2026-11-05T14:46:13+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-ca-certificates-update-to-fix-jks-keystore-s.html 

## Summary
Ubuntu has issued a security update for the ca-certificates and ca-certificates-java packages to address a synchronization failure. A bug was identified where the Java Keystore (JKS) integration failed to properly reflect changes made to the system-wide certificate bundle.

This issue specifically affected users where CA certificates were removed from the primary system bundle but remained present in the JKS keystore. The update corrects this integration logic and performs a resync to ensure the JKS keystore matches the current system CA certificate list. The fix is available for Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10.

## JKS Integration and Synchronization Fix
- **Bug Mechanism:** The ca-certificates JKS integration failed to trigger deletions in the Java Keystore when certificates were removed from the main system bundle.
- **Affected Packages:** The fix involves updates to both the core 'ca-certificates' package and the 'ca-certificates-java' package responsible for JKS management.
- **Resolution Method:** The update implements a resynchronization process that aligns the JKS keystore state with the active system CA certificate list.
- **Version Specifics:** Fixes are deployed across multiple Ubuntu release branches, including Jammy (22.04), Noble (24.04), Resolute (26.04), and 26.10.

## Why it matters
This update is critical for Java-based applications running on Ubuntu that rely on the system's trust store for secure communications. By ensuring that removed or untrusted certificates are actually purged from JKS, it prevents potential security vulnerabilities where deprecated certificates might still be accepted by Java runtimes.