Conversation

Mitigating CVE-2026-111943 on #Debian:

- sudo dpkg-reconfigure ca-certificates
- Select "ask" and deselect the following entries:
mozilla/emSign_ECC_Root_CA_-_C3.crt
mozilla/emSign_ECC_Root_CA_-_G3.crt
mozilla/emSign_Root_CA_-_C1.crt
mozilla/emSign_Root_CA_-_G1.crt
- Hit <Ok>

Alternatively you can edit /etc/ca-certificates.conf manually and add the specific entries:

!mozilla/emSign_ECC_Root_CA_-_C3.crt
!mozilla/emSign_ECC_Root_CA_-_G3.crt
!mozilla/emSign_Root_CA_-_C1.crt
!mozilla/emSign_Root_CA_-_G1.crt

...and sudo update-ca-certificates

#CVE_2026_111943

The compromised certificates are also signed by Comodo (Sectigo) "AAA Certificate Services" root. However the website trust for this CA was removed in 2025: https://bugzilla.mozilla.org/show_bug.cgi?id=1957685

That being said, disabling Comodo_AAA_Services_root.crt might be prudent in some situations. Note however that doing so might lead to various other intermediate certificates being untrusted, too.

Another comment: Technically merely "emSign_ECC_Root_CA_-_G3.crt" out of the eMudhra roots would need to be removed to mitigate the currently known leaked private keys. However, considering the circumstances around the leak of the private keys are not known, I refuse to trust any eMudhra root at this time.