eMudhra Intermediate CA Compromise
- ID
- 37641
- Status
- summarized
- Published
- 21 Oct 2026, 7:50 AM
- Fetched
- 23 Oct 2026, 12:17 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Oct/20/emudhra-certificates/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 7.0
- Created
- 23 Oct 2026, 12:18 AM
- Tags
- Audience
- developersvibe_codersai_ml_learners
What happened
The private keys for eight eMudhra intermediate CA certificates were compromised; they chain to roots trusted by Mozilla, Microsoft, Apple, Chrome, and many downstream trust stores. Simon Willison notes that any software bundling trusted certificates must be updated, and points to a GitHub repository tracking updates. Python releases already shipped upgraded certificate lists: uv 0.13.4, pip 26.2.2, and certifi 2026.10.19.
Why it matters
If you ship Python apps or run CI with pip/uv, upgrade to uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 or later, and make sure Linux hosts update their ca-certificates packages; otherwise TLS verification can fail or trust stale intermediates. Decide whether to pin certifi versions and add a certificate-bundle update check to your release process.
Discussion angle
How should teams handle CA bundle updates in pinned environments and CI images—automate them with dependency updates, or rely on base image rebuilds? What breaks if certifi stays pinned?