Bug#1153054: ca-certificates-java: removed / revoked CA certificates not removed from certificate store

[Peter Gerber]

Package: ca-certificates-java
Version: 20240118
Severity: normal
Tags: security
X-Debbugs-Cc: Debian Security Team <team at security.debian.org>

Dear Maintainer,

various certificates including "emSign ECC Root CA - G3" have
been removed / revoked as part of DSA 6572-1. However, this CA
certificate, and others, are still trusted by Java after an
upgrade.

$ cat >Main.java <<EOF
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;
import java.nio.channels.Channels;
import java.nio.channels.ReadableByteChannel;

public class Main {
    public static void main(String[] args) throws IOException {
        URL website = new URL("https://dv-g3b-emudhra.we-have-a-problem.com/");
        ReadableByteChannel rbc = Channels.newChannel(website.openStream());
        FileOutputStream fos = new FileOutputStream("data");
        fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
    }
}
EOF
$ javac Main.java
$ java Main
$ cat data
Your client successfully connected to the site. That's bad!

I also tried the official Debian Docker image where I see an error:

$ java Main
Exception in thread "main" javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

So, maybe this only affect upgraded installations, not fresh
installations. I checked three upgraded installations, all
were affected.

wget too reports an error:

$ wget --spider https://dv-g3b-emudhra.we-have-a-problem.com/
Spider mode enabled. Check if remote file exists.
--2026-11-04 20:30:53--  https://dv-g3b-emudhra.we-have-a-problem.com/
Resolving dv-g3b-emudhra.we-have-a-problem.com (dv-g3b-emudhra.we-have-a-problem.com)... 54.39.60.141, 204.168.130.246
Connecting to dv-g3b-emudhra.we-have-a-problem.com (dv-g3b-emudhra.we-have-a-problem.com)|54.39.60.141|:443... connected.
ERROR: The certificate of "dv-g3b-emudhra.we-have-a-problem.com" is not trusted.
ERROR: The certificate of "dv-g3b-emudhra.we-have-a-problem.com" doesn't have a known issuer.

And the certificate appears in the certificate store:

$ java --version
openjdk 21.0.13 2026-10-20
OpenJDK Runtime Environment (build 21.0.13+9-1-deb13u2-Debian)
OpenJDK 64-Bit Server VM (build 21.0.13+9-1-deb13u2-Debian, mixed mode, sharing)
$ keytool -list -v -cacerts -storepass 'changeit' | grep 'emSign ECC Root CA - G3'
Owner: CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
Issuer: CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN

All the best

Peter

-- System Information:
Debian Release: 13.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'proposed-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.115+deb13.1-amd64 (SMP w/20 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ca-certificates-java depends on:
ii  ca-certificates  20250419+deb13u1

ca-certificates-java recommends no packages.

ca-certificates-java suggests no packages.

-- Configuration Files:
/etc/default/cacerts [Errno 13] Permission denied: '/etc/default/cacerts'

-- no debconf information