Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

Ubuntu drops emSign and Comodo roots after compromised intermediates

1 source · 3 articlesFirst reported Updated ()1 · 1 read
What's new

October 21: USN-8947-1 removes both emSign ECC Root CA - G3 and Comodo AAA Services root from NSS, citing compromised intermediates.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ubuntu has removed the emSign ECC and Comodo AAA roots from ca-certificates and NSS after compromised intermediates.

Ubuntu is removing the "emSign ECC Root CA - G3" certificate because intermediate CA certificates were compromised, and is also dropping the "Comodo AAA Services root." USN-8944-1, published October 20, covers Ubuntu 22.04, 24.04, and 26.04 LTS and replaces outdated trust-store contents with Mozilla's 2.90 CA bundle. USN-8944-2 the same day extends the removals to Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS. On October 21, USN-8947-1 removes both roots from NSS, again citing compromised intermediates. The notices do not name the intermediates, give a CVE, or describe active misuse.

Key facts
  • emSign ECC Root CA - G3 is removed after compromised intermediate certificates.
  • Comodo AAA Services root is also removed from older ca-certificates releases and NSS.
  • Ubuntu 22.04, 24.04, and 26.04 LTS are refreshed to Mozilla CA bundle 2.90.
  • USN-8944-2 covers Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS.
  • USN-8947-1 applies both root removals to NSS.
  • Notices give no CVE, NSS package versions, or misuse details.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026USN-8944-1 removes emSign root and refreshes newer LTS stores. · Ubuntu Security Notices
  2. Oct 20, 2026USN-8944-2 extends both root removals to older LTS releases. · Ubuntu Security Notices
  3. Oct 21, 2026USN-8947-1 drops both roots from NSS. · Ubuntu Security Notices

What each outlet adds

beyond the shared facts
  • Ubuntu Security NoticesUSN-8944-1 refreshes 22.04, 24.04, and 26.04 to Mozilla 2.90.
  • Ubuntu Security NoticesUSN-8944-2 adds Comodo removal on 14.04 through 20.04 LTS.
  • Ubuntu Security NoticesUSN-8947-1 removes both roots from NSS without a CVE.
Vendors
Ubuntu
Products
ca-certificatesNSS
Organizations
Mozilla

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Ubuntu Security NoticesFirst report

    Ubuntu removes emSign ECC Root CA - G3 after CA compromise

    22.04, 24.04 and 26.04 LTS also refresh ca-certificates to the Mozilla 2.90 authority bundle.

  2. · 4d ago Ubuntu Security Notices

    Ubuntu removes emSign and Comodo root CAs on older LTS

    USN-8944-2 drops both roots on Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS after compromised emSign intermediates.

  3. · 4d ago Ubuntu Security Notices

    Ubuntu NSS update removes two root CAs after intermediate compromise

    The notice drops emSign ECC Root CA - G3 and the Comodo AAA Services root from NSS.