Teku and Besu List Four Roots for Removal From Docker Images

Ethereum node operators using Teku or Besu binaries may still have Java trust stores containing roots listed for Docker removal, affecting the security of configured HTTPS connections.

Teku 26.10.3, released Oct. 27, lists four roots for removal from its Docker images and marks the update recommended. Besu 26.10.2, released Oct. 26, lists the same four: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and AAA Certificate Services. Besu’s change applies only to Docker images; archive users may still run a Java distribution that trusts those roots.

The weak private keys belonged to eight eMudhra intermediate certificate authorities, rather than the four roots named in the releases. eMudhra attributed the weak keys to a script error. “The flaw was ours. A script error resulted in issuing CA’s with weak keys,” eMudhra said.

For binary installations, changing the client version does not necessarily update Java’s trust store. Teku’s binary distribution uses the Java runtime installed by the operator, and trust-store contents vary among Java distributions. A client version number alone therefore may not show whether the runtime trusts the listed roots.

Java does not perform certificate revocation checks by default. The risk concerns configured outbound HTTPS connections, such as links to a remote signer or another node service, when the runtime still trusts a certificate chain through an affected root. Teku’s peer-to-peer networking does not use certificate authorities, so those connections are outside this issue.

Teku mainnet setups without HTTPS URLs are unaffected, and no exploitation has been reported. Teku handles consensus in Ethereum’s two-client node setup, while Besu handles execution. The listed Docker changes concern certificate trust in the images, not Ethereum’s protocol. The Teku release follows TokenPost’s earlier coverage of the eMudhra certificate risk.