Open Source Lab incident
osuosl.org HTTPS certificate not trusted on Amazon Linux and some Java runtimes
Ongoing since 07:20 PM UTC, affecting Core IPv6 Network and Core IPv6 Network (Core IPv6 Network — Salem, OR) and 1 more.
Some clients can no longer verify the HTTPS certificate on most of our osuosl.org sites, including the ftp.osuosl.org mirrors (ftp-nyc, ftp-chi and ftp-osl). Downloads fail with "unable to get local issuer certificate" (curl error 60) or a Java "unable to find valid certification path" error. Who is affected: - Amazon Linux 2023 and Amazon Linux 2 hosts with the latest ca-certificates package (ALAS2023-2026-3306, ALAS2-2026-4037), which removed every eMudhra root. - Java runtimes whose trust store has dropped eMudhra's emSign Root CA - G1. - Anything else that has removed all eMudhra roots, such as a corporate trust policy. Not affected: Web browsers and most Linux distributions still trust this certificate, and the sites themselves are up. What happened: The *.osuosl.org certificate most of our sites use comes from InCommon and chains to eMudhra's emSign Root CA - G1. After last month's eMudhra key compromise, which involved a different eMudhra hierarchy, some vendors removed all eMudhra roots, including this one. The Jenkins project has temporarily taken our mirrors out of its download rotation for this reason. What we're doing: We are moving the ftp.osuosl.org mirrors to Let's Encrypt certificates, which we expect to finish in the next couple of weeks, and will post here when they have switched. Our other osuosl.org certificates will move off eMudhra before the current certificate expires in February. If you are affected and need help in the meantime, email [email protected].
Affected components
Update timeline
- identified Nov 04, 2026, 07:20 PM UTC
Some clients can no longer verify the HTTPS certificate on most of our osuosl.org sites, including the ftp.osuosl.org mirrors (ftp-nyc, ftp-chi and ftp-osl). Downloads fail with "unable to get local issuer certificate" (curl error 60) or a Java "unable to find valid certification path" error. Who is affected: - Amazon Linux 2023 and Amazon Linux 2 hosts with the latest ca-certificates package (ALAS2023-2026-3306, ALAS2-2026-4037), which removed every eMudhra root. - Java runtimes whose trust store has dropped eMudhra's emSign Root CA - G1. - Anything else that has removed all eMudhra roots, such as a corporate trust policy. Not affected: Web browsers and most Linux distributions still trust this certificate, and the sites themselves are up. What happened: The *.osuosl.org certificate most of our sites use comes from InCommon and chains to eMudhra's emSign Root CA - G1. After last month's eMudhra key compromise, which involved a different eMudhra hierarchy, some vendors removed all eMudhra roots, including this one. The Jenkins project has temporarily taken our mirrors out of its download rotation for this reason. What we're doing: We are moving the ftp.osuosl.org mirrors to Let's Encrypt certificates, which we expect to finish in the next couple of weeks, and will post here when they have switched. Our other osuosl.org certificates will move off eMudhra before the current certificate expires in February. If you are affected and need help in the meantime, email [email protected].
Your product runs on more than Open Source Lab
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services