USN-9001-1: Ubuntu fixes Java keystore, eMudhra CA remained trusted
Ubuntu releases USN-9001-1: the JKS keystore wasn't aligned with the system trust store, leaving previously revoked CAs trusted, including eMudhra.
UptimeMag editorial team · 5 November 2026 · 2 min read
On 5 November 2026, Ubuntu published advisory USN-9001-1, which addresses a defect in the ca-certificates-java package: the JKS keystore used by Java applications was not updated when a CA was removed from the system bundle. For those running Tomcat, application servers or any Java service reading /etc/ssl/certs/java/cacerts instead of the OpenSSL trust store, this had practical implications: certificates that the system considered revoked remained trusted on the Java side.
The cause: two invocations, only one valid
The bug, tracked on Launchpad as issue 2061817, dates back to a report from April 2024. In updates to the ca-certificates package, update-ca-certificates was invoked twice, the first time with an empty hooksdir, meaning hooks in /etc/ca-certificates/update.d such as jks-keystore were not executed. Result: the Java keystore stopped receiving CA updates, whilst the system ca-certificates package remained perfectly up to date.
The connection to the eMudhra case
The timing of the fix is not coincidental. Official changelog entries for 24.04, 26.04 and 26.10 explain that the ca-certificates postinst applied certificate changes without executing the hooks in /etc/ca-certificates/update.d, so the deferred update fed this package with an empty list of changes and the keystore stopped receiving updates; it continued to trust CAs removed from the system trust store since then, including the eMudhra root. In practice, those who had already applied the USN-8944-1 fix in October for the compromised eMudhra CA case were fine at the operating system level, but Java applications could continue to trust the compromised chain until this update.
Fixed versions
| Release | ca-certificates | ca-certificates-java |
|---|---|---|
| 26.10 | 20260816ubuntu0.26.10.2 | 20260311ubuntu0.26.10.1 |
| 26.04 LTS | 20260816ubuntu0.26.04.2 | 20260311ubuntu0.26.04.1 |
| 24.04 LTS | 20260816ubuntu0.24.04.2 | 20240118ubuntu0.24.04.1 |
| 22.04 LTS | 20260816ubuntu0.22.04.2 | 20190909ubuntu1.4 |
What to do
A sudo apt update && sudo apt upgrade applies the corrected versions. After the update, for those running Java applications in production it's worth verifying the keystore with keytool -list -cacerts -storepass changeit to check that no aliases referring to CAs already removed from the system bundle appear. The technical reference for the bug remains on Launchpad at https://bugs.launchpad.net/bugs/2061817.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).