Ubuntu removes compromised emSign CA: update ca-certificates on all releases
USN-8944-1 removes the emSign ECC G3 root after eight eMudhra intermediate CAs had keys stolen, and updates the Mozilla certificate bundle to version 2.90.
UptimeMag editorial team · 21 October 2026 · 2 min read
Ubuntu released security notice USN-8944-1 on 20 October 2026, updating the ca-certificates package across all supported releases: 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10. This affects anyone managing Ubuntu servers that validate TLS certificates—essentially every machine making outbound HTTPS calls or verifying client certificates.
What's changing
The update removes the "emSign ECC Root CA - G3" certificate authority from the trusted certificate bundle. According to the Ubuntu notice, the intermediate CAs linked to that root have been compromised. Additionally, on 22.04 LTS, 24.04 LTS and 26.04 LTS the package contained outdated certificates: the new version aligns the bundle with Mozilla's 2.90 release.
The context behind the removal is broader than the Ubuntu notice alone suggests. A researcher reported the compromise on 17 October 2026, and Mozilla and the Chrome Root Program confirmed it on 20 October: six compromised TLS certificates had been issued by emSign Root TLS CA - G3 and chain back to emSign ECC Root CA - G3, a root present in Chrome and Apple stores and, until 20 October, in Mozilla's. In total, eight intermediate CAs had compromised private keys—six for TLS and two for code signing. The concrete risk for those who don't update: an attacker in possession of one of the compromised keys can issue valid certificates for any hostname, and if they're also on the network path they can intercept or modify TLS traffic from clients that trust the bundle containing that root.
It's not just Ubuntu: the Go language had to intervene as well, blocking the same eight keys in versions 1.27.3 and 1.26.10 (CVE-2026-111943). Anyone with services compiled in Go must recompile them; updating the toolchain alone isn't enough.
How to update
The correct package versions are as follows:
| Release | Code name | Package version |
|---|---|---|
| 26.10 | stonking | ca-certificates – 20260816ubuntu0.26.10.1 |
| 26.04 LTS | resolute | ca-certificates – 20260816ubuntu0.26.04.1 |
| 24.04 LTS | noble | ca-certificates – 20260816ubuntu0.24.04.1 |
| 22.04 LTS | jammy | ca-certificates – 20260816ubuntu0.22.04.1 |
A standard system update (apt update && apt upgrade) applies the changes. The associated Launchpad reference is bug 2171507.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).