Dear Maintainer,

various certificates including "emSign ECC Root CA - G3" have
been removed / revoked as part of DSA 6572-1. However, this CA
certificate, and others, are still trusted by Java after an
upgrade.

$ cat >Main.java <<EOF
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;
import java.nio.channels.Channels;
import java.nio.channels.ReadableByteChannel;

public class Main {
    public static void main(String[] args) throws IOException {
        URL website = new URL("https://dv-g3b-emudhra.we-have-a-problem.com/");
        ReadableByteChannel rbc = Channels.newChannel(website.openStream());
        FileOutputStream fos = new FileOutputStream("data");
        fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
    }
}
EOF
$ javac Main.java
$ java Main
$ cat data
Your client successfully connected to the site. That's bad!

I also tried the official Debian Docker image where I see an error:

$ java Main
Exception in thread "main" javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

So, maybe this only affect upgraded installations, not fresh
installations. I checked three upgraded installations, all
were affected.

wget too reports an error:

$ wget --spider https://dv-g3b-emudhra.we-have-a-problem.com/
Spider mode enabled. Check if remote file exists.
--2026-11-04 20:30:53--  https://dv-g3b-emudhra.we-have-a-problem.com/
Resolving dv-g3b-emudhra.we-have-a-problem.com (dv-g3b-emudhra.we-have-a-problem.com)... 54.39.60.141, 204.168.130.246
Connecting to dv-g3b-emudhra.we-have-a-problem.com (dv-g3b-emudhra.we-have-a-problem.com)|54.39.60.141|:443... connected.
ERROR: The certificate of "dv-g3b-emudhra.we-have-a-problem.com" is not trusted.
ERROR: The certificate of "dv-g3b-emudhra.we-have-a-problem.com" doesn't have a known issuer.

And the certificate appears in the certificate store:

$ java --version
openjdk 21.0.13 2026-10-20
OpenJDK Runtime Environment (build 21.0.13+9-1-deb13u2-Debian)
OpenJDK 64-Bit Server VM (build 21.0.13+9-1-deb13u2-Debian, mixed mode, sharing)
$ keytool -list -v -cacerts -storepass 'changeit' | grep 'emSign ECC Root CA - G3'
Owner: CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
Issuer: CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN

All the best

Peter