20th October 2026
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
How do we know?
To demonstrate that the keys are compromised, the original reporter Wayne signed the following message with the private key of each of the eight intermediate CAs and reported it to the Root Program Teams on the 17th of October:
We have a problem here - Wayne
proof.zip contains the message, and for each intermediate the certificate, its public key and a signature on the message. To verify with OpenSSL:
openssl x509 -in EM-DV-TLS-CA-G3B.crt.pem -noout -pubkey | diff - EM-DV-TLS-CA-G3B.pub.pem openssl dgst -sha384 -verify EM-DV-TLS-CA-G3B.pub.pem -signature EM-DV-TLS-CA-G3B.sig message.txt
What actions have been taken?
The root programs and many downstream trust stores have taken action to protect their users. The certificates have been blocked in Firefox and Chrome since the 17th of October, in Apple devices since the 19th and on Microsoft platforms since the 20th.
The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates.
What are the consequences?
An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.
This has already been remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets.
The CA has also revoked the compromised intermediate certificates. However, many other clients do not consume revocation information and require software updates to ensure they no longer trust the compromised intermediates.
Does your client still trust the compromised intermediates?
| Intermediate CA | Chains to | Result |
|---|
To check curl or other command-line clients, run:
curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
A certificate error means the client does not trust the compromised intermediates.
To check a trust store offline, chains.zip contains the certificate chain served by each of the twelve hosts above in PEM format, with instructions for verifying them with OpenSSL.
What is known about the cause?
The private keys for the intermediate certificates were incorrectly generated by the CA. This means that anyone can recover them from the certificates.
This would have been possible since the certificates were created in April 2025. There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients.
Further technical information about the cause is captured in the initial incident report in Mozilla's bug tracker.
Which clients aren't yet patched?
The servers behind the checker record how many times each user-agent connects successfully, meaning it still trusts the compromised intermediates. Only these counts are recorded. See the user-agent statistics.
A JSON dump with more detail, including counts for each JA4 fingerprint, is also available.
impacted-intermediates.json lists the eight intermediates and their Sectigo cross-signs. roots.json lists the roots they chain to.
What actions can trust store operators take?
Please see this thread in Mozilla's dev-security-policy forum.
What actions can users take?
Users should update their browsers and operating systems to the latest versions as soon as possible.
Who has patched?
| Software | Patched version |
|---|---|
| Ubuntu ca-certificates | 20260816ubuntu0.22.04.1, 20260816ubuntu0.24.04.1, 20260816ubuntu0.26.04.1, 20260816ubuntu0.26.10.1 |
| Debian ca-certificates | 20250419~deb12u2, 20250419+deb13u1, 20260816+nmu1 |
| Devuan ca-certificates | Same as Debian |
| Arch Linux ca-certificates-mozilla | 3.131.1-1 |
| Gentoo ca-certificates | 20260816.3.125 |
| Fedora ca-certificates | 2026.2.92_v9.0.319 |
| FreeBSD caroot | 15.1-RELEASE-p6, 14.5-RELEASE-p3, 14.4-RELEASE-p12 |
| FreeBSD ca_root_nss | 1.131.1 |
| Freedesktop SDK | 25.08.19, 26.08.3 |
| Chainguard ca-certificates | 20260909-r3 |
| Alpine Linux ca-certificates | 20261020-r0 |
| GNU Guix | 7608a99 |
| OmniOS web/ca-bundle | r151054by, r151056ay, r151058y |
| Bottlerocket | pending |
| NSS | 3.131.1 |
| curl CA bundle | 2026-10-20 |
| Cloudflare CFSSL trust store | 2026.10.1 |
| Homebrew ca-certificates | 2026-09-25_1 |
| Go | 1.27.3, 1.26.10 |
| Java | 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.33.0.2, 8u511 (OpenJDK, Oracle JDK) |
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Python certifi | 2026.10.19 |
| pip | 26.2.2 |
| uv | 0.13.4 |
| pixi | 0.82.1 |
| Rust rustls-webpki | 0.103.16 |
| Rust webpki-roots / webpki-root-certs | 1.0.10 |
| Rustup | 1.29.2 |
| Electron | 44.9.1, 43.8.1, 42.11.16 |
| Bun | pending |
| Claude Code | 2.1.303 |
| Composer ca-bundle | 1.4.16, 1.6.0 |
| Elixir castore | 1.0.22 |
| Erlang certifi | pending |
| mise | 2026.10.17 |
| Perl Mozilla::CA | 20261020 |
| Deno | 2.9.8 |
Add more at github.com/galadran/we-have-a-problem.com.
Are there workarounds for macOS curl, git, and Python?
macOS blocks the compromised intermediates, but the built-in curl, git, python3, perl, ruby, and openssl verify certificates against /etc/ssl/cert.pem without checking revocation, and that file has not been updated. To remove the affected roots from it, run:
sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.bak &&
sudo awk '/^(###|===) /{skip=0}
/^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
!skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/null
The built-in pip3, and the pip in virtual environments created from the built-in python3, use their own outdated copy of the roots instead. To make them use the fixed system file, run:
F="$(/usr/bin/python3 -c 'import sysconfig; print(sysconfig.get_path("stdlib"))')/sitecustomize.py" &&
echo 'import os; os.environ.setdefault("PIP_CERT", "/etc/ssl/cert.pem")' | sudo tee -a "$F" > /dev/null &&
sudo chmod 644 "$F"
For nix-darwin users, please **additionally** follow NixOS instructions.
Are there workarounds for Linux?
Until a distribution ships an updated ca-certificates package, expert users can distrust the affected roots in the system trust store. This is NOT recommended for ordinary users.
On Debian and Ubuntu, run as root:
sed -i \ -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \ -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \ /etc/ca-certificates.conf && update-ca-certificates
On Alpine, run as root:
apk add ca-certificates && sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \ /etc/ca-certificates.conf && update-ca-certificates
On Fedora, RHEL, CentOS Stream, Rocky Linux, AlmaLinux and Amazon Linux 2023, run as root:
d=/etc/pki/ca-trust/source/blocklist; [ -d $d ] || d=/etc/pki/ca-trust/source/blacklist trust extract --overwrite --format=pem-bundle \ --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \ $d/Comodo_AAA_Services_root.pem && trust extract --overwrite --format=pem-bundle \ --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \ $d/emSign_ECC_Root_CA_-_G3.pem && update-ca-trust
On openSUSE and SLES, run as root:
d=/etc/pki/trust/blocklist; [ -d $d ] || d=/etc/pki/trust/blacklist trust extract --format=pem-bundle \ --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \ $d/Comodo_AAA_Services_root.pem && trust extract --format=pem-bundle \ --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \ $d/emSign_ECC_Root_CA_-_G3.pem && update-ca-certificates
On Arch Linux, run as root:
trust extract --format=pem-bundle \ --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \ /etc/ca-certificates/trust-source/blocklist/emSign_ECC_Root_CA_-_G3.pem && update-ca-trust
On NixOS, add to your configuration:
security.pki.caCertificateBlacklist = [ "Comodo AAA Services root" "emSign ECC Root CA - G3" ];
Are there workarounds for Windows?
Microsoft has shipped blocks for these certificates through Windows' automatic certificate trust list updates. Machines that receive these updates don't need this workaround. This script lets administrators block the compromised certificates locally on machines that do not, for example those that are offline or have automatic updates disabled.
This mitigation is not recommended for enterprise-managed devices. Your IT department will manage the rollout; contact them before applying local changes.
Download and inspect Block-EmudhraCompromisedCA.ps1, then run it from an elevated PowerShell terminal. Requires PowerShell 5.1 or later and the built-in Windows PKI module. This command bypasses execution policy for this process only; it does not change the machine's policy. Organization-enforced policies may still prevent execution.
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Block-EmudhraCompromisedCA.ps1
The script imports its 16 compromised intermediates and cross-signs into LocalMachine\Disallowed (Untrusted Certificates).
This mitigation applies to clients using the Windows operating system certificate trust stores and chain validation (including Schannel TLS and Authenticode). It adds blocks to Untrusted Certificates without modifying Trusted Root Certification Authorities. Applications using independent CA bundles still need their own updates.
Are there workarounds for NetBSD?
On NetBSD 10 and later, run as root:
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem && certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem
Are there workarounds for FreeBSD?
On FreeBSD 14 or later, run the following commands as root:
cp /etc/ssl/certs/14bc7599.0 /usr/share/certs/untrusted/14bc7599.pem cp /etc/ssl/certs/ee64a828.0 /usr/share/certs/untrusted/ee64a828.pem certctl rehash
Site published by Dennis Jackson. This site is the work of many contributors from the community. The source is on GitHub and PRs are welcome.