Ubuntu removes compromised emSign and Comodo root CAs from NSS

Brief written by the FOSSWire AI editor from Ubuntu How we write

October 21, 2026 1 min read

Key Takeaway

Ubuntu has issued a security update removing two root CA certificates from NSS after their intermediate CAs were compromised.

Summary

USN-8947-1 removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates from the nss package across all supported Ubuntu releases from 14.04 ESM through 26.10. The removal follows compromise of intermediate CA certificates issued under these roots. Affected systems should apply standard updates to receive patched libnss3 packages.

Affected releases and packages

Removed CAs: "emSign ECC Root CA - G3" and "Comodo AAA Services root"
Root cause: Intermediate CA certificates under these roots were compromised
Package: libnss3 (Network Security Service library)
Coverage: 14.04 ESM through 26.10, including Ubuntu Pro/ESM releases for older LTS versions
Fix: Standard system update; no manual configuration changes required

Why it matters

Root CA removals break TLS validation for any remaining certificates chained to the compromised roots, which may affect legacy services still using these CAs. The broad backporting to 14.04 ESM reflects the severity of the compromise.

Original reference: ubuntu.com →