Certifi: Bundled eMudhra root CAs with compromised intermediate keys
Certifi versions before 2026.10.18 included emSign roots whose intermediate keys were compromised. An attacker able to position on path could use a fraudulent certificate to intercept TLS traffic.
Triage facts
Revision 2- Applicability
- certifi (< 2026.10.18)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 20, 23:53 UTC
- Source quality
- A1
Revision history 1 entry · Revision 2
The certifi maintainer removed emSign root certificates from the bundled CA store in version 2026.10.18 after intermediates chaining to those roots were revoked for key compromise. Mozilla separately reported the compromise of eight eMudhra intermediate certificates. A compromised CA key can enable fraudulent certificates and a man-in-the-middle attack when an attacker is on path. The cited advisories do not report an observed attack against certifi users.
Impact
Applications that use an affected certifi CA bundle for TLS validation may trust certificates issued through the compromised intermediates. The risk depends on whether the application uses that bundle and whether an attacker can intercept its connection.
Recommendation
- Identify applications and images that use certifi versions before 2026.10.18.
- Upgrade affected installations to certifi 2026.10.18 or later and rebuild images that bundle an older release.
- Check which TLS clients use certifi rather than an operating-system trust store so remediation targets the affected paths.
Immediate actions
Upgrade certifi to 2026.10.18 or later in affected environments
Mitigations
Rebuild container images that vendor certifi
certifi (< 2026.10.18)