Here is a "bigger hammer" blacklisting "emSign Root TLS CA - G3" (and "AAA Certificate Services"), although the later would not be strictly needed for the packaging.
The same could be done for a trixie-security update. Regards, Salvatore
diff -Nru ca-certificates-20260816/debian/changelog ca-certificates-20260816+nmu1/debian/changelog --- ca-certificates-20260816/debian/changelog 2026-08-16 23:04:36.000000000 +0200 +++ ca-certificates-20260816+nmu1/debian/changelog 2026-10-20 16:40:44.000000000 +0200 @@ -1,3 +1,11 @@ +ca-certificates (20260816+nmu1) unstable; urgency=medium + + * Non-maintainer upload. + * Blacklist "emSign ECC Root CA - G3" and "Comodo AAA Services root" + (Closes: #1151413) + + -- Salvatore Bonaccorso <[email protected]> Tue, 20 Oct 2026 16:40:44 +0200 + ca-certificates (20260816) unstable; urgency=medium * Update Mozilla certificate authority bundle to version 2.90 diff -Nru ca-certificates-20260816/mozilla/blacklist.txt ca-certificates-20260816+nmu1/mozilla/blacklist.txt --- ca-certificates-20260816/mozilla/blacklist.txt 2026-08-16 22:50:20.000000000 +0200 +++ ca-certificates-20260816+nmu1/mozilla/blacklist.txt 2026-10-20 16:39:50.000000000 +0200 @@ -3,4 +3,9 @@ # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors "Explicitly Distrust DigiNotar Root CA" +# Blacklist "emSign ECC Root CA - G3" (cf. #1151413) +"emSign ECC Root CA - G3" +# Blacklist "Comodo AAA Services root" (cf. #1151413) +"Comodo AAA Services root" + # Expired CAs
