Hi, On Tue, Oct 20, 2026 at 04:52:39PM +0200, Salvatore Bonaccorso wrote: > Here is a "bigger hammer" blacklisting "emSign Root TLS CA - G3" (and > "AAA Certificate Services"), although the later would not be strictly > needed for the packaging. > > The same could be done for a trixie-security update.
And here the same for trixie-security. Salvatore
diff -Nru ca-certificates-20250419/debian/changelog ca-certificates-20250419+nmu1/debian/changelog --- ca-certificates-20250419/debian/changelog 2025-04-19 09:25:37.000000000 +0200 +++ ca-certificates-20250419+nmu1/debian/changelog 2026-10-20 16:57:59.000000000 +0200 @@ -1,3 +1,11 @@ +ca-certificates (20250419+nmu1) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * Blacklist "emSign ECC Root CA - G3" and "Comodo AAA Services root" + (Closes: #1151413) + + -- Salvatore Bonaccorso <[email protected]> Tue, 20 Oct 2026 16:57:59 +0200 + ca-certificates (20250419) unstable; urgency=medium [ Alexander Kanavin ] diff -Nru ca-certificates-20250419/mozilla/blacklist.txt ca-certificates-20250419+nmu1/mozilla/blacklist.txt --- ca-certificates-20250419/mozilla/blacklist.txt 2023-03-11 09:37:33.000000000 +0100 +++ ca-certificates-20250419+nmu1/mozilla/blacklist.txt 2026-10-20 16:57:49.000000000 +0200 @@ -3,4 +3,9 @@ # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors "Explicitly Distrust DigiNotar Root CA" +# Blacklist "emSign ECC Root CA - G3" (cf. #1151413) +"emSign ECC Root CA - G3" +# Blacklist "Comodo AAA Services root" (cf. #1151413) +"Comodo AAA Services root" + # Expired CAs
