How to disable compromised "emSign ECC Root CA \- G3" and "AAA Certificate Services" CA root certificates on Agent-based Installer OCP environments
Issue
- Compromised eMudhra intermediate CA certificates can still be trusted on some OpenShift clusters even after RHCOS /
ca-certificatesupdates for CVE-2026-114406 - Node OS trust-store mitigation (KCS 7149347) does not remove compromised roots that were copied into
openshift-config/user-ca-bundle - Customer must manually remove all CAs, except their own, from
user-ca-bundle
Environment
- Red Hat OpenShift Container Platform (RHOCP) 4.15
- Clusters first installed with the Agent-based Installer
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
