Ubuntu removes emSign ECC Root CA - G3 after CA compromise
Original title: USN-8944-1: ca-certificates update
22.04, 24.04 and 26.04 LTS also refresh ca-certificates to the Mozilla 2.90 authority bundle.
Ubuntu security notice USN-8944-1 removes the "emSign ECC Root CA - G3" CA certificate because intermediate CA certificates were compromised. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS, the ca-certificates package also held outdated CA certificates. The update replaces those with the set in version 2.90 of the Mozilla certificate authority bundle. The notice does not name the compromised intermediates or describe active misuse.
Unconfirmed: The notice does not identify the compromised intermediate certificates or say they were used in attacks.
- The removed root is named "emSign ECC Root CA - G3".
- Outdated trust stores are called out only for 22.04, 24.04 and 26.04 LTS.
- Replacement content matches Mozilla's 2.90 CA bundle.
- No CVE identifier is given in the notice.
Impact: Compromised intermediate CAs could undermine trust in issued certificates
| Product | Affected | Fixed in |
|---|---|---|
| Ubuntu ca-certificates | Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS had outdated CA certificates | certificates from Mozilla bundle 2.90 |
- 1.Install the updated ca-certificates package so the emSign ECC Root CA - G3 certificate is removed.
- Vendors
- Ubuntu
- Products
- ca-certificates
- Organizations
- Mozilla
From the original article
This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22. 04 LTS, Ubuntu 24.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.