eMudhra CA Compromise: The Trust Stores You Didn't Patch | Endor Labs

What it is

On 20 October 2026, the private keys of eight eMudhra intermediate CA certificates were disclosed as recoverable, because the keys were generated incorrectly and can be derived from the certificates. The intermediates were issued in April 2025 and chain to four roots, including the legacy Sectigo root AAA Certificate Services, both directly and via Sectigo cross-signatures. Anyone holding a key can issue a certificate for any hostname that an affected client accepts. Endor Labs' post focuses on non-browser software, where the real exposure remains.

How it works

Firefox and Chrome blocked the intermediates on 17 October 2026, Apple on 19 October and Microsoft on 20 October. The CA has also revoked them. Most server-side clients do none of that: they build a chain and accept it if a root in their trust store anchors it. Default TLS stacks in Python, Ruby, Go, Node.js and most command-line tools skip revocation, and most skip certificate transparency (CT). There are no CT log entries for these intermediates, which rules out attacks on CT-enforcing clients but not on the rest. Only a trust store update removes the risk.

Libraries that ship their own PEM bundle are the hidden part. They declare no dependency on a certificate bundle package, have no fixed version on any list, and ignore OS updates. Endor Labs checked two libraries, and both bundle AAA Certificate Services:

• Python HTTP client (fallback pattern): a 71-certificate bundle. It is used only if no env-var file, trust store locator or certifi is found. Minimal or slim container images fall through to the stale bundle.
• Ruby HTTP client gem (default pattern): a 153-certificate bundle taken from Mozilla's list of 28 October 2015. It is the default trust anchor unless application code opts into OpenSSL's default paths.

The post reports 25 fairly popular packages trusting a root in the compromised chains, 11 already patched. It contrasts this with other reports of 29 affected packages.

Preconditions / Affected

• Clients that skip revocation and CT, and load a bundled or system root store containing any of the four roots.
• The JDK ships its own cacerts keystore and is not on the fixed list, so Java services are unconfirmed.
• emSign Root CS CA - G3 is a code signing root trusted by Microsoft, so code-signature verification chaining to eMudhra needs separate review.
• FreeBSD ca_root_nss and Bun had fixes pending at the time of writing.

What to do

Fixed versions named on the page:

• certifi 2026.10.19 (pin it wherever Python runs, even if undeclared, since it changes which store fallback-pattern libraries load)
• Alpine ca-certificates 20261020-r0
• Go go1.27.3 and go1.26.10
• Rust webpki-roots 1.0.10
• Electron 44.9.1, 43.8.1 and 42.11.16
• composer/ca-bundle 1.4.16 and 1.6.0

The page also lists Ubuntu, Debian and Wolfi ca-certificates versions, and says NSS, curl, Node.js, pip, uv and Rustup will come in a follow-up.

To find hidden stores, scan source trees, installed environments and container filesystems for PEM files, and compare each certificate's SHA-256 fingerprint to the affected roots. The page supplies a bash and openssl script for this. Its four root fingerprints are:

D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4
86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B
7DD78D5F4F13459A83DFF9ABBBA62EDBAF6F2D102BF257FD712F4D9F2746ED8D
F2EDAAFF3D9B701FB4D14C9F285F8C0BAD90FC3BCC1FA07D47F4718EDABA34A5

Add the eight intermediates from impacted-intermediates.json to catch bundles that include them directly. Test each client from its real runtime environment. A certificate error means it rejects the chains, and a successful connection means it still trusts them:

curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

To fix a hidden store, point the library at a patched file through its env var, option or constructor argument. For the default-load pattern, change application code to use the system store. On Debian-family hosts, verify the OS fix; the result should be 0:

sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates
grep -c "emSign" /etc/ssl/certs/ca-certificates.crt

For past exposure, review TLS inspection, proxy and endpoint logs since April 2025 for server certificates issued by the eight intermediates. Prioritise clients carrying credentials, such as API clients, CI jobs, package managers and update mechanisms.

Endor Labs tracks affected packages under CVE-2026-111943 (originally created for the Go runtime) and GHSA-6q48-6c7w-9gw2 (certifi). The post includes endorctl api list filters for DependencyMetadata.

Caveats

• Removing AAA Certificate Services by hand can break legitimate legacy Sectigo chains. Replacing an outdated bundle with a current one is safer.
• Distrusting the eMudhra roots is offered only as an interim measure.
• Endor Labs cannot see trust stores on hosts, network appliances, IoT devices or third-party SaaS.
• The search for bundled stores was ongoing as of 21 October 2026.
• The Endor Labs filters and several fixes are specific to its tooling and the versions listed above.