ALAS2027-2026-256

The system certificate authority (CA) store in Amazon Linux, distributed via the ca-certificates RPM package, included multiple root CA certificates belonging to authorities that signed eMudhra intermediate CA certificates with weak private keys.

The root CA certificates that signed the weak intermediates were removed under CVE-2026-113470, which is the primary fix for this exposure: https://explore.alas.aws.amazon.com/CVE-2026-113470.html. Systems with that update installed no longer trust the weak intermediate CA certificates.

CVE-2026-114406 additionally removes the remaining CA certificates that were associated with the same CA operators, and removing them ensures no residual trust in those operators remains in the system CA store:

- emSign Root CA - G1
- emSign Root CA - G2 (Code signing)
- emSign Root CA - C2 (Code signing)
- AAA Certificate Services root (already distrusted for TLS since 2025)

Customers who still require eMudhra's "emSign Root CA - G1" can re-enable that certificate via the following commands:

sudo curl https://repository.emsign.com/certs/emSignRootCAG1.crt --output /etc/pki/ca-trust/source/anchors/emSignRootCAG1.crt
sudo update-ca-trust (CVE-2026-114406)

noarch:
    ca-certificates-2026.2.90_v9.0.316-101.0.amzn2027.noarch

src:
    ca-certificates-2026.2.90_v9.0.316-101.0.amzn2027.src