Update your CA root trust stores
eMudhra CA Intermediate Certificates have been compromised, CA updates needed on all TLS components.
by Dan Janowski
on Oct 20, 2026
As reported by Mozilla the eMudhra intermediate CA private keys have been compromised. These CA records can only be excluded by either enabling CRL (Certificate Revocation Lists) checking or by installing updated root CA certificate stores.
CRL checking is not enabled by default. Without active CRL checking, CA records can only be eliminated by installing new root CA certificates that do not include them. An advanced alternative is to create a certificate deny.
Do the following:
- System CA certificate store (update OS or container images/packages) to include new Mozilla records
- Update ca-store package at least 1.0.22
- Update certifi when it is updated past 2.17.0
- Update hex
More information about the eMudhra problem.