Debian ca-certificates: emSign ECC Root CA G3 and Comodo AAA Services root removed (DSA-6572-1)
Summary
Debian found that several eMudhra intermediate CA certificates have been compromised. Security advisory DSA-6572-1 (published 2026-10-20) provides updated ca-certificates packages that remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" root certificates. Once the update is installed, certificates chaining to these roots are no longer trusted.
What changes?
After installing the updated ca-certificates package, TLS (encrypted connections) to servers whose certificate chain depends on the "emSign ECC Root CA - G3" or "Comodo AAA Services root" may fail with certificate validation errors. The advisory does not list specific error messages.
Affected
- Debian systems with the ca-certificates package installed
- Services and applications that rely on the Debian system trust store and connect to servers using certificates chained to the removed roots
Preparation and temporary exceptions
No workaround known.
Check and complete
Install the updated ca-certificates package from the Debian security repository (see DSA-6572-1). The advisory does not state a package version number.
Recommendation
Install the update on Debian systems after checking which internal and external services use certificates issued under the two removed roots. If such services exist, ask the operators to switch to certificates from a different trusted CA before or right after the update. Test critical connections (APIs, mail, proxies, monitoring) after updating.
Timeline
- Debian publishes DSA-6572-1: updated ca-certificates packages remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates.
Sources
- DSA-6572-1 ca-certificates - security update Vendor · lists.debian.org
- Debian Security Tracker: DSA-6572-1 Vendor · security-tracker.debian.org
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:38.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.