# Ubuntu removes compromised emSign and Comodo root CAs from NSS

> **Key takeaway:** Ubuntu has issued a security update removing two root CA certificates from NSS after their intermediate CAs were compromised.

**Published:** 2026-10-21T17:40:27+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-removes-compromised-emsign-and-comodo-root-cas-from-n.html 

## Summary
USN-8947-1 removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates from the nss package across all supported Ubuntu releases from 14.04 ESM through 26.10. The removal follows compromise of intermediate CA certificates issued under these roots. Affected systems should apply standard updates to receive patched libnss3 packages.

## Affected releases and packages
- **Removed CAs**: "emSign ECC Root CA - G3" and "Comodo AAA Services root"
- **Root cause**: Intermediate CA certificates under these roots were compromised
- **Package**: libnss3 (Network Security Service library)
- **Coverage**: 14.04 ESM through 26.10, including Ubuntu Pro/ESM releases for older LTS versions
- **Fix**: Standard system update; no manual configuration changes required

## Why it matters
Root CA removals break TLS validation for any remaining certificates chained to the compromised roots, which may affect legacy services still using these CAs. The broad backporting to 14.04 ESM reflects the severity of the compromise.