Ubuntu Removes Compromised CA Certificates in Security Update

Ubuntu has published security updates addressing trust concerns within its ca-certificates package. The primary action involves the removal of the "emSign ECC Root CA - G3" certificate following reports of compromised intermediate certificates. Additionally, several long-term support releases received updates to synchronize with the current Mozilla CA certificate authority bundle, ensuring systems maintain up-to-date and trusted root certificates.

This adjustment aims to mitigate risks associated with potentially untrusted certificate authorities that could be exploited in man-in-the-middle attacks or other TLS-based threats. Organizations relying on Ubuntu's certificate validation mechanisms are encouraged to deploy these updates promptly across affected systems.

Certificate Removal and Trust Impact

• The emSign ECC Root CA - G3 certificate was removed due to known compromises of intermediate certificates under this root.
• Removal affects Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, and 20.04 LTS as part of USN-8944-2.
• Systems using these older LTS versions may see TLS connection failures to sites previously signed by the removed CA.

CA Bundle Synchronization

• Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS received refreshed CA certificates aligned with Mozilla’s 2.90 bundle.
• This resolves issues where outdated or deprecated certificates might have remained trusted longer than recommended.
• Organizations can now rely on a more current set of trusted root certificates consistent with industry standards.

Sources

• USN-8944-1: ca-certificates update
• USN-8944-2: ca-certificates update