Ubuntu removes CA certificates after eMudhra intermediate compromise

What happened and what to do

The Ubuntu Security advisory USN-8944-2 follows USN-8944-1 and covers LTS releases 14.04, 16.04, 18.04 and 20.04. The update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates, the first because of the compromise of intermediate certificates linked to the eMudhra incident. On 22.04, 24.04 and 26.04 LTS, the package contained outdated CA certificates, which were renewed to match version 2.90 of the Mozilla CA bundle.

For a company, the practical consequence is that systems trusting chains issued by these CAs will reject those connections after the update, which can break integrations, data collectors and internal APIs. A safe path is to inventory which servers, containers and pipelines use the affected packages, test the update in staging, monitor TLS validation errors after rollout, and keep a record of which certificates were removed and why. In environments with custom trust chains, it is also worth reviewing internal certificates added manually.

How the consultancy can help

Exposure assessment for removed certificates across Ubuntu fleets, including an inventory of affected hosts and pipelines and a patch plan with staging tests. Implementation of TLS error monitoring and alerts for chain validation failures after rollout, operated within a defined scope.

Next step

If your organization runs Ubuntu servers, data collectors or integrations that depend on TLS connections, send a short description of your environment and case. We will reply with a scoped proposal for inventory, update and monitoring.