Compromised Certificates and OpenJDK Java Runtimes

As has been widely reported, the private keys of eight eMudhra intermediate CA certificates have been compromised.

How to check whether your runtime is at risk

Run the CheckCerts.java program. It works on JDK 8 and later.

Standalone OpenJDK Java runtimes

If you use a standalone OpenJDK Java runtime downloaded from a vendor, take one of the following actions immediately — even if you have updated your runtime in the past few days.

• Preferred: Update your OpenJDK Java runtime

  When available, download and install an updated runtime from your preferred vendor. The runtime’s release note should document that it fixes issue JDK-8395690, CVE 2026-114820.

  If your vendor has not yet published an updated runtime, consider one of the remaining actions.

• Otherwise: Remove the relevant root certificates

  1. Back up your runtime’s keystore. For JDK 11 and later, the keystore is in the file

     $JDK_HOME/lib/security/cacerts

     For JDK 8, the keystore is in the file

     $JDK_HOME/jre/lib/security/cacerts

  2. Remove the relevant root certificates from your runtime’s keystore. For JDK 11 and later:

     $ keytool -delete -cacerts -alias "emsignrootcag1 [jdk]"
     $ keytool -delete -cacerts -alias "emsignrootcag2 [jdk]"
     $ keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
     $ keytool -delete -cacerts -alias "comodoaaaca [jdk]"

     For JDK 8:

     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsignrootcag1 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsignrootcag2 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsigneccrootcag3 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "comodoaaaca [jdk]"

     Ignore any error messages saying that a certificate does not exist.

  3. Restart any live instances of the runtime.

  If you have more than one standalone OpenJDK Java runtime installed, repeat these steps for each installation.

• Or else: Check for revoked certificates

  • For an application that uses TLS, if you have not already enabled revocation checking, add

    -Dcom.sun.net.ssl.checkRevocation=true
    -Dcom.sun.security.enableCRLDP=true

    to the application’s java command line.

  • For signed JAR files, with JDK 17 and later, use

    $ jarsigner -verify -revcheck -strict $SIGNED_JAR

    to verify each signed JAR and check revocation.

Operating-system provided OpenJDK Java runtimes

If you use an OpenJDK Java runtime provided by an operating-system package, it most likely uses the operating system’s certificates.

• This is true of the OpenJDK packages in Arch Linux, Fedora, Gentoo, Oracle Linux, and Red Hat Enterprise Linux. For these systems, updating the operating system’s certificates is likely sufficient.

• OpenJDK Java runtime packages in Debian Linux and derived distributions (e.g., Devuan and Ubuntu) require a manual workaround. These runtimes are intended to use the operating system’s certificates from the ca-certificates package via the related ca-certificates-java package. Due to a long-standing bug in the latter, however, updating these two packages is not sufficient. The workaround is to remove and recreate the operating system’s Java keystore. To do this, you must be the superuser:

  # rm -f /etc/ssl/certs/java/cacerts
  # update-ca-certificates --fresh

• OpenJDK Java runtime packages in FreeBSD and Homebrew do not use the operating system’s certificates. Update the packages directly once updates are available.