This bug was fixed in the package ca-certificates-java -
20190909ubuntu1.4
---------------
ca-certificates-java (20190909ubuntu1.4) jammy-security; urgency=medium
* debian/postinst: add heal_cacerts() to reconcile the
/etc/ssl/certs/java/cacerts keystore with the current contents of
/etc/ssl/certs once on upgrade. The ca-certificates postinst has
been applying certificate changes without running the
/etc/ca-certificates/update.d hooks, so this keystore stopped
receiving updates in 2022 and still trusts CAs that were removed
from the system trust store since then, including the eMudhra root
(LP: #2061817, Debian #1069251). The reconciliation drops stale
package-managed debian:-prefixed aliases and re-imports the current
set. Non-debian: aliases are untouched; local CAs managed through
/usr/local/share/ca-certificates are retained.
* d/control: depend on ca-certificates (>= 20260816ubuntu0.22.04.2) so the
one-time reconciliation cannot be installed without the fixed
ca-certificates postinst; otherwise future updates would be lost again.
-- Vyom Yadav <[email protected]> Thu, 22 Oct 2026 18:52:38
+0530
** Changed in: ca-certificates (Ubuntu Resolute)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2061817
Title:
[regression][security] ca-certificates.postinst does not feed
adds/removes to hooks
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2061817/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
