USN-9001-1: ca-certificates update

Q: Which systems are affected by the stale certificate entries?

Systems using the ca-certificates JKS integration may be affected. The issue applies when CA certificates have been removed from the system bundle but remain present in the JKS keystore.

Q: What is the practical security impact of this issue?

Java applications that rely on the JKS keystore may continue to trust CA certificates that administrators removed from the system CA bundle. This creates a difference between the intended system trust configuration and the trust anchors available to those applications.

Q: What does the update change?

The update fixes the JKS integration and resynchronizes the JKS keystore with the current system CA certificate list. CA certificates removed from the system bundle are removed from the keystore during this resynchronization.

Published Nov 5, 2026

Updated

It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

Affected Software

16 affected componentsFixes available

All of the following

ubuntu/ca-certificates<20260816ubuntu0.26.10.2

20260816ubuntu0.26.10.2

Ubuntu Ubuntu=26.10

All of the following

ubuntu/ca-certificates-java<20260311ubuntu0.26.10.1

20260311ubuntu0.26.10.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/ca-certificates<20260816ubuntu0.26.04.2

20260816ubuntu0.26.04.2

Ubuntu Ubuntu=26.04

All of the following

ubuntu/ca-certificates-java<20260311ubuntu0.26.04.1

20260311ubuntu0.26.04.1

Ubuntu Ubuntu=26.04

All of the following

ubuntu/ca-certificates<20260816ubuntu0.24.04.2

20260816ubuntu0.24.04.2

Ubuntu Ubuntu=24.04

All of the following

ubuntu/ca-certificates-java<20240118ubuntu0.24.04.1

20240118ubuntu0.24.04.1

Ubuntu Ubuntu=24.04

All of the following

ubuntu/ca-certificates<20260816ubuntu0.22.04.2

20260816ubuntu0.22.04.2

Ubuntu Ubuntu=22.04

All of the following

ubuntu/ca-certificates-java<20190909ubuntu1.4

20190909ubuntu1.4

Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ca-certificates to a version that resolves this vulnerability.
Fixed in 20260816ubuntu0.26.10.2
Upgrade
Upgrade ubuntu/ca-certificates-java to a version that resolves this vulnerability.
Fixed in 20260311ubuntu0.26.10.1
Upgrade
Upgrade ubuntu/ca-certificates to a version that resolves this vulnerability.
Fixed in 20260816ubuntu0.26.04.2
Upgrade
Upgrade ubuntu/ca-certificates-java to a version that resolves this vulnerability.
Fixed in 20260311ubuntu0.26.04.1
Upgrade
Upgrade ubuntu/ca-certificates to a version that resolves this vulnerability.
Fixed in 20260816ubuntu0.24.04.2
Upgrade
Upgrade ubuntu/ca-certificates-java to a version that resolves this vulnerability.
Fixed in 20240118ubuntu0.24.04.1
Upgrade
Upgrade ubuntu/ca-certificates to a version that resolves this vulnerability.
Fixed in 20260816ubuntu0.22.04.2
Upgrade
Upgrade ubuntu/ca-certificates-java to a version that resolves this vulnerability.
Fixed in 20190909ubuntu1.4
Upgrade
Upgrade ca-certificates to a version that resolves this vulnerability.
Patch USN-9001-1

Event History

Nov 5, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Which systems are affected by the stale certificate entries?

Systems using the ca-certificates JKS integration may be affected. The issue applies when CA certificates have been removed from the system bundle but remain present in the JKS keystore.

What is the practical security impact of this issue?

Java applications that rely on the JKS keystore may continue to trust CA certificates that administrators removed from the system CA bundle. This creates a difference between the intended system trust configuration and the trust anchors available to those applications.

What does the update change?

The update fixes the JKS integration and resynchronizes the JKS keystore with the current system CA certificate list. CA certificates removed from the system bundle are removed from the keystore during this resynchronization.

USN-9001-1: ca-certificates update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are affected by the stale certificate entries?

What is the practical security impact of this issue?

What does the update change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected by the stale certificate entries?

What is the practical security impact of this issue?

What does the update change?