Your Best Solution to all Linux Based ProblemsDebian NSS Update Removes eMudhra Roots: Check the Package Revision
The Debian NSS update announced on October 31 removes three root certificates after several eMudhra intermediate CA certificates were compromised. On Debian 13 trixie, the fixed version is 2:3.110-1+deb13u5. Looking only for an upstream version newer than 3.110 would miss the important part: Debian delivered this fix in its package revision.
Check the installed library, not just the version headline
Debian’s DSA-6599-1 security advisory recommends upgrading NSS packages. Its trixie libnss3 package page lists the same fixed revision and identifies nss as the source package.
On the affected system, inspect the installed package before deciding the update is already present:
dpkg-query -W libnss3
apt policy libnss3The first command reports the installed libnss3 version. The second separates Installed from Candidate, which helps distinguish a package already running on the machine from an update merely offered by its configured repositories. A candidate at the fixed revision does not mean the installed copy has caught up.
Compare the complete version string, including the leading 2: and the ending +deb13u5. An installation still reporting an earlier Debian revision of 3.110 has not reached the version specified in this advisory. A later applicable Debian security revision may include subsequent changes as well.
Which trust entries changed?
The advisory names three removed roots: eMudhra emSign Root CA - G3, eMudhra emSign Root CA - C1, and emSign ECC Root CA - C3. It describes compromised intermediate CA certificates and removal of those roots in the updated packages. Those statements should not be rewritten as proof that every named root’s private key was compromised.
The practical consequence is a change in what affected software can trust. Software relying on this NSS library may reject a certificate chain that previously depended on one of the removed trust anchors. That is a reason to investigate the chain, rather than defeat certificate checking to make a warning disappear.
Apply the Debian fix on Debian
Use your normal Debian security-update process to install the offered NSS updates, then repeat the installed-version check. If applications were open during a shared-library update, restart the affected applications before relying on their new state; checking the package database alone does not establish what an existing process has loaded.
Our earlier report on Arch’s certificate and PHP warnings concerned a different distribution and its ca-certificates-mozilla package. Its package name and minimum revision are not substitutes for Debian’s libnss3 check.
This advisory specifies the stable trixie fix. Do not apply that revision as a universal target for another Debian release or an independently bundled application. Start with the release and package actually installed, then use the matching distributor’s security instructions.