Ubuntu Extends Java Truststore Fix to 18.04 and 20.04
Tech GuruQuick Answer
Update the entitled Ubuntu CA packages, verify Java truststore synchronization and test approved TLS connections. Review custom trust anchors before rollout and retain truststore comparison evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Ubuntu release, Ubuntu Pro entitlement, both certificate packages, JVM consumers and custom truststore configuration. Ubuntu 18.04 LTS and 20.04 LTS ca-certificates and ca-certificates-java packages with the listed Ubuntu Pro fixes. Apply both listed CA packages from the supported Ubuntu Pro repositories for the release. Follow Ubuntu update instructions to resynchronize the system-managed Java keystore. Confirm package versions, verify removed system CAs no longer persist in the managed JKS store and test expected trusted and untrusted TLS chains; retain configuration and validation evidence.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | CA certificates on supported Ubuntu releases |
|---|---|
| Advisory | USN-9001-2 |
| CVEs | |
| Authoritative release date | November 9, 2026; official Ubuntu RSS publication timestamp 2026-11-09T12:01:46+00:00. |
| Authority revision date | No later revision is stated. |
| Affected versions | Ubuntu 18.04 LTS and 20.04 LTS ca-certificates and ca-certificates-java packages with the listed Ubuntu Pro fixes. |
| Fixed version | 20.04: ca-certificates 20240203~20.04.2ubuntu0.1~esm3 and ca-certificates-java 20190405ubuntu1.2~esm1; 18.04: ca-certificates 202402031ubuntu0.18.04.2+esm4 and ca-certificates-java 20180516ubuntu1~18.04.3+esm1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state exploitation in this notice.; no exploitation claim is inferred. |
What Changed
Ubuntu extended the USN-9001-1 truststore correction to 18.04 and 20.04. Removed system CA certificates could remain in the Java JKS keystore; the update repairs synchronization and resynchronizes it with the system CA list.
What To Validate Now
- Inventory. Record Ubuntu release, Ubuntu Pro entitlement, both certificate packages, JVM consumers and custom truststore configuration.
- Establish applicability. Ubuntu 18.04 LTS and 20.04 LTS ca-certificates and ca-certificates-java packages with the listed Ubuntu Pro fixes.
- Remediate. Apply both listed CA packages from the supported Ubuntu Pro repositories for the release. Follow Ubuntu update instructions to resynchronize the system-managed Java keystore.
- Validate. Confirm package versions, verify removed system CAs no longer persist in the managed JKS store and test expected trusted and untrusted TLS chains; retain configuration and validation evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Removing stale trust anchors can change Java application connectivity. Identify independently managed application truststores and custom CAs separately; do not restore a removed CA merely to suppress a connection failure. The authority assigns no CVE or CVSS score in this notice.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
