The Trust Center (eMudhra post) is the authoritative source as IA releases official guidance.
Overview: Remove the two root certificates the compromised intermediates chain to (“emSign ECC Root CA - G3” and “AAA Certificate Services”) from the Java trust store of each affected Ignition runtime: the Gateway, Designer, Vision Client, launchers, and Workstation. This matches Oracle’s guidance at https://ops.java/emudhra.
Scope. This affects outbound HTTPS connections an Ignition component makes that an attacker on the network path can intercept: Gateway Network peers, identity providers, mail servers, web APIs called from scripts. Prioritize Gateways and clients that reach HTTPS services across the internet or untrusted networks.
Not affected: inbound connections to the Gateway; Gateway Network connections using two way authentication with an approved only policy (the default); and Perspective sessions in a browser, which use the browser’s trust store.
Side effects. Removing these roots also stops the runtime from trusting any server whose certificate chains only to one of them, including certificates eMudhra issued under emSign ECC Root CA - G3. Before you remove them, check the HTTPS services your Gateways and clients connect to, and watch for certificate errors after the restart. To revert, restore the backup.
Steps. Back up the runtime’s lib/security/cacerts, run the two keytool deletes with that runtime’s own keytool (store password changeit), then restart the Gateway and relaunch clients.
Back up: in each runtime folder, copy lib/security/cacerts to cacerts.orig.
Remove the roots (must run on the correct JRE):
Windows (PowerShell): & "<runtime>\bin\keytool.exe" -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit
Windows (PowerShell): & "<runtime>\bin\keytool.exe" -delete -cacerts -alias "comodoaaaca [jdk]" -storepass changeit
Linux and macOS: "<runtime>/bin/keytool" -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit
Linux and macOS: "<runtime>/bin/keytool" -delete -cacerts -alias "comodoaaaca [jdk]" -storepass changeit
Note: <runtime> is the runtime folder you are patching. Always give keytool's full path, even from inside the runtime's bin folder: a bare keytool runs whichever Java is on the system path, and -cacerts then changes that Java's trust store instead of Ignition's. Each runtime's keytool is in its bin folder:
Gateway: C:\Program Files\Inductive Automation\Ignition\lib\runtime\jre-win on Windows, /usr/local/bin/ignition/lib/runtime/jre-* on Linux, /usr/local/ignition/lib/runtime/jre-mac on macOS.
Designer and Vision Client: one runtime per Gateway version for each user, in C:\Users\<user>\.ignition\cache\resources\runtimes\<version> on Windows and ~/.ignition/cache/resources/runtimes/<version> on Linux and macOS.
Launchers and Workstation: the jre folder in the install folder on Windows, <Launcher name>.app/Contents/Resources/runtime on macOS, and the runtime folder you extracted the launcher into on Linux.
On Linux and macOS, the keytool in a Designer or Vision Client runtime isn't marked executable. Run it through that runtime's java with the same options instead, for example:
<runtime>/bin/java -m java.base/sun.security.tools.keytool.Main -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit
If keytool reports that the alias emsigneccrootcag3 [jdk] does not exist, that runtime stores the root under a different name, as some older Ignition versions do. Find the name, then run the first delete again with it:
Windows (PowerShell):
& "<runtime>\bin\keytool.exe" -list -v -cacerts -storepass changeit | Select-String "Owner: CN=emSign ECC Root CA - G3" -Context 5,0
Linux and macOS:
"<runtime>/bin/keytool" -list -v -cacerts -storepass changeit | grep -B 5 "Owner: CN=emSign ECC Root CA - G3" | grep "Alias name"
Docker. Changes made inside a container are lost when it is recreated, for example on an upgrade or a configuration change. Run these steps again after each recreate, or mount a copy of cacerts with the roots removed over /usr/local/bin/ignition/lib/runtime/jre/lib/security/cacerts.
Check: confirm both roots are gone. These commands print nothing once confirmed:
Windows (PowerShell):
& "<runtime>\bin\keytool.exe" -list -v -cacerts -storepass changeit | Select-String "86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31"
Linux and macOS:
"<runtime>/bin/keytool" -list -v -cacerts -storepass changeit | grep -E "86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31"
To Undo: copy cacerts.orig back over cacerts and restart the Gateway or relaunch the client.
When to repeat. Upgrading the Gateway or a launcher replaces its runtime, so repeat these steps afterward. A patched Gateway still sends unpatched runtimes to Designers and Vision Clients, so also repeat them on a workstation whenever it downloads a new runtime: for a new user, after the cache is cleared, or after a Gateway upgrade.
What comes next. Scripts that apply this to every runtime on a machine are in QA and will be announced via the Trust Portal (subscribe) and posted here. Upcoming 8.1 and 8.3 maintenance releases will bundle a runtime with these roots removed.