Ubuntu removes compromised emSign root CA, refreshes certificate bundle
Ubuntu's ca-certificates update removes a compromised root CA and refreshes outdated certificates on LTS releases to Mozilla's 2.90 bundle.
Summary
Ubuntu published USN-8944-1 to address two certificate issues. The update removes the "emSign ECC Root CA - G3" root certificate after intermediate CAs under it were compromised. For Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS, it also replaces outdated CA certificates with the current Mozilla CA bundle version 2.90. All Ubuntu users relying on system certificate stores should apply this update promptly.
What changed in ca-certificates
- emSign ECC Root CA - G3 removed: Intermediate CA certificates in this trust chain were compromised, making the root untrustworthy
- Mozilla CA bundle updated to 2.90: Replaces stale certificates on 22.04 LTS, 24.04 LTS, and 26.04 LTS
- Affected package: ca-certificates (system-wide TLS trust store)
- No immediate application-level patches required: This is a data package update, not a code change
Why it matters
Certificate authority compromises can enable man-in-the-middle attacks if clients still trust the affected root. The refresh also resolves potential TLS connection failures from expired or distrusted CAs that had accumulated in the LTS releases' certificate stores.
Original reference: ubuntu.com →