** Description changed: On an up-to-date Ubuntu 26.04.1 system, every OpenJDK application still - trusts the compromised eMudhra intermediate CA removed under LP - #2171507. The system trust store no longer contains the root, but the - Java trust store, /etc/ssl/certs/java/cacerts, does. + trusts the compromised eMudhra root removed under LP #2171507. The + system trust store no longer contains the root, but the Java trust + store, /etc/ssl/certs/java/cacerts, does. Versions: ca-certificates 20260816ubuntu0.26.04.1, ca-certificates-java 20260311 Steps to reproduce: Precondition: ca-certificates-java and a JRE are installed, and apt has upgraded ca-certificates to 20260816ubuntu0.26.04.1. 1. Run `ls /etc/ssl/certs | grep -i emsign_ecc_root_ca_-_g3`. - Expected: the system store does not contain the root. + Expected: the system store does not contain the root. 2. Run - `keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass changeit | grep -i emsign_ecc_root_ca_-_g3`. - Result: - debian:emsign_ecc_root_ca_-_g3.pem, e.g. Apr 7, 2026, trustedCertEntry, + `keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass changeit | grep -i emsign_ecc_root_ca_-_g3`. + Result: + debian:emsign_ecc_root_ca_-_g3.pem, e.g. Apr 7, 2026, trustedCertEntry, 3. Run `sudo update-ca-certificates --fresh`, then repeat step 2. - Result: the same line as in step 2, since the rebuild doesn't remove the root + Result: the same line as in step 2, since the rebuild doesn't remove the root Before step 3, /etc/ssl/certs/java/cacerts on my system had last been modified on 2026-04-07. That file also still contained roots that the June and October 2026 ca-certificates uploads removed, for example "Atos TrustedRoot 2011". Debian merge request ca-certificates!6 describes a related loss of updates to the hooks in ca-certificates.postinst.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171995 Title: Java cacerts receives no certificate changes from ca-certificates upgrades. Removed roots (eMudhra) stay trusted by OpenJDK To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2171995/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
