eMudhra CA compromise fixes available

Key points

The Ubuntu Security Team has updated the ca-certificates package after the eMudhra Certificate Authority's private keys were shown on 20 October 2026 to be compromised. Two root CAs that cross-sign eMudhra have been removed from Ubuntu's trusted root store so that the compromised CA is no longer trusted.

What changed

• eMudhra is not a trusted root on Ubuntu, but it was reachable through cross-signatures from two roots: emSign Root TLS CA – G3 and Comodo AAA Certificate Services.
• Both of these roots are now removed from the store shipped in ca-certificates.
• Comodo AAA Certificate Services had already been dropped from the bundles in Ubuntu 22.04 (Jammy Jellyfish) and later releases.
• Any legitimate certificate that chains up to either removed root will no longer validate. Ubuntu considers it unlikely, but some hosts using such certificates may become unreachable.

Why it matters

• Whoever holds the keys can issue fraudulent X.509 certificates that pass validation in any TLS client trusting eMudhra.
• This allows impersonation of TLS endpoints and attacker-in-the-middle interception of TLS connections, whatever CA the real server uses.
• Public key pinning and DNS CAA records can detect such certificates, but only when the application uses them, which is uncommon.

**Fixed versions of ca-certificates**

• Trusty (14.04): 20230311~14.04.1~esm3
• Xenial (16.04): 202402031~16.04.1~esm3
• Bionic (18.04): 202402031ubuntu0.18.04.1+esm3
• Focal (20.04): 20240203~20.04.1ubuntu0.1~esm2
• Jammy (22.04): 20260816ubuntu0.22.04.1
• Noble (24.04): 20260816ubuntu0.24.04.1
• Resolute (26.04): 20260816ubuntu0.26.04.1
• Stonking (26.10): 20260816ubuntu0.26.10.1

How to check and upgrade

• Check the installed version of the package:

dpkg -l 'ca-certificates' | grep ^ii

• Ubuntu recommends a full package upgrade:

sudo apt update && sudo apt upgrade

• If a full upgrade is not possible, upgrade only the affected package:

sudo apt update && sudo apt install --only-upgrade ca-certificates

• On Ubuntu 16.04 LTS and later, unattended-upgrades is on by default and installs security updates every 24 hours, so systems with it enabled will get the fix within a day of release.

Who gets the fix

• Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS receive it under standard support.
• Ubuntu 20.04 LTS and older need an Ubuntu Pro subscription with Expanded Security Maintenance (ESM). Pro is free for up to 5 machines, or up to 50 for community members, and includes Landscape for managing rollout of fixes.

Desktop users

• Browsers on Ubuntu Desktop are usually snaps and do not use the system trust store from ca-certificates.
• Snaps refresh four times a day by default. Anyone who has turned off automatic updates should refresh snaps manually.

References

• Security notices USN-8944-1 and USN-8944-2.

Summary by DistroNews, based on the original post.