Ubuntu: ca-certificates update removes emSign ECC Root CA - G3 and refreshes CA certificates
Summary
Canonical updated the ca-certificates package. The CA certificate "emSign ECC Root CA - G3" is removed because intermediate CA certificates were compromised. On Ubuntu 22.04, 24.04 and 26.04 LTS the certificates are also refreshed to Mozilla CA bundle version 2.90. A standard system update applies the changes.
What changes?
After the update, certificates issued under the removed emSign ECC Root CA - G3 are no longer trusted, so TLS connections to services using them may fail. On Ubuntu 14.04 to 20.04 LTS, certificates chained to the Comodo AAA Services root are also no longer trusted. The sources do not list specific error messages.
Affected
- Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS (USN-8944-1): emSign ECC Root CA - G3 removed, certificates refreshed to Mozilla bundle 2.90
- Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS (USN-8944-2): emSign ECC Root CA - G3 and Comodo AAA Services root removed
Preparation and temporary exceptions
No workaround known.
Check and complete
Install the standard system update for the ca-certificates package, as described in USN-8944-1 and USN-8944-2.
Recommendation
Install the ca-certificates update on all Ubuntu systems. Before rolling it out, check whether internal or external services use certificates chained to emSign ECC Root CA - G3 (or, on older releases, Comodo AAA Services root), and test critical TLS connections afterwards.
Timeline
- USN-8944-1 published for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS: removes emSign ECC Root CA - G3 and refreshes certificates to Mozilla CA bundle 2.90.
- USN-8944-2 published for Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS and 20.04 LTS: removes emSign ECC Root CA - G3 and Comodo AAA Services root.
Sources
- USN-8944-1: ca-certificates update Vendor · ubuntu.com
- USN-8944-2: ca-certificates update Vendor · ubuntu.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:38.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.