Ubuntu removes two root certificates from NSS after intermediate compromise

What happened and what to do

The security advisory USN-8947-1, published by Ubuntu Security on 21 October 2026, covers an update to NSS, the cryptography library that browsers and other programs use to validate secure connections. The update removes two root certificate authority certificates, emSign ECC Root CA - G3 and Comodo AAA Services root, because intermediate certificates chaining to them were compromised. In practice, connections relying on those trust chains are no longer accepted by the system.

For a company, this case calls for an inventory and operations response, not just applying the package. A diagnosis can map which servers, internal applications, integrations and workstations use libraries that consume NSS, and which depend on chains passing through these roots. A monitoring pipeline can then track security advisories for the distributions in use, record installed versions and alert when a critical package is outdated. It is also worth testing, in a controlled environment, whether internal services and integrations with external vendors keep working after removal, before rolling the fix out to production.

How the consultancy can help

Diagnosis of the impact of the certificate removal on the company's systems and integrations, including a survey of dependencies on trust chains. Then implementation of continuous monitoring of security advisories and cryptographic package versions, with alerts and a controlled testing and deployment process for the fix.

Next step

If your company needs to understand whether this update affects internal or vendor connections, send a short description of your environment (operating systems, critical applications and integrations) and receive a proposal with a defined scope.