Fedora Account System
Red Hat Associate
Red Hat Customer
You probably heard of the compromised eMudhra certificates which had very easy to factor private keys. I think this can be serious for some users, a quick update would be beneficial for all the users of Fedora. I did not see any updates in Bodhi yet. Hopefully this is the right component to report this. https://emudhra.we-have-a-problem.com/ Some projects are tracking this under CVE-2026-111943 Reproducible: Always Steps to Reproduce: 1. curl https://dv-g3b-emudhra.we-have-a-problem.com/ Actual Results: Your client successfully connected to the site. That's bad! Expected Results: Connection should be refused because the ssl certificate is not to be trusted. Additional Information: Either block the compromised intermediate keys or maybe the whole CA
Proposed as a Blocker for 45-final by Fedora user pbrobinson using the blocker tracking app because: https://emudhra.we-have-a-problem.com/ Major security issues, especially that can affect network, block the release.
Good component, we are working on a fix, will be removing: emSign ECC Root CA - G3 AAA Certificate Services root certificates as we don't yet have mechanism that will distrust the intermediates for all crypto libraries.
We need to do an RC today if we're going to make Thursday's go/no-go. Will the update be ready in the next few hours?
When exactly is the cut-off, I am kinda prone to do some mistakes at this point... Also as a fix before the update happens you can run d=/etc/pki/ca-trust/source/blocklist; [ -d $d ] || d=/etc/pki/ca-trust/source/blacklist trust extract --overwrite --format=pem-bundle \ --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \ $d/emSign_ECC_Root_CA_-_G3.pem && trust extract --overwrite --format=pem-bundle \ --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \ $d/Comodo_AAA_Services_root.pem && update-ca-trust
updates are in, please verify them.
FEDORA-2026-78521f021a (ca-certificates-2026.2.92_v9.0.319-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-78521f021a
+4 in https://forge.fedoraproject.org/quality/blocker-review/issues/2236 , marking accepted blocker.