Fix eMudhra

May need manual steps. Google pushed a block for the eight cracked certificates through Google Play services around 22:00 UTC on 19 October. Most phones have it already. If yours is old, offline a lot, or has no Google services, disable the root by hand.

What to do

1. Restart the phone. Google says a restart makes Play services apply the block straight away.
2. Open Settings and search for Trusted credentials. If search finds nothing, try these paths:

   • Pixel and most phones: Security & privacy → More security & privacy → Encryption & credentials → Trusted credentials
   • Samsung: Security and privacy → More security settings → View security certificates
   • Xiaomi, Redmi, POCO: Passwords & security → Privacy → Encryption & credentials → Trusted credentials
3. Open the System tab. Scroll to eMudhra Technologies Limited, tap emSign ECC Root CA - G3, scroll down and tap Disable. Leave the other eMudhra entries alone.
4. Optional, and it can break a few older sites: under Comodo CA Limited, tap AAA Certificate Services and choose Disable. This blocks the Sectigo cross-signed copies of the same keys.
5. If you use Firefox for Android, update it to 158.0.2 or later from the Play Store. It keeps its own blocklist.

Check it worked

Open the disclosure site checker in Chrome and in any other browser you use. A warning page on the test links means you are protected.

Undo

Return to the same screen and tap Enable on the certificate.

Some phones do not let you disable system certificates, and menu names differ between makers and Android versions.

Sources: Google Chrome & Android, Disclosure site and checker, Mozilla security blog

Protected automatically. Apple blocks the 12 affected TLS certificates on its own since 19 October 2026 and the emSign ECC Root CA - G3 root since 23 October. It arrived as configuration data, so no software update was needed. Safari, Mail and apps built on Apple frameworks are covered.

What to do

1. Make sure the device has been online since 23 October. That is enough for the block to arrive.
2. Install any waiting update in Settings → General → Software Update.
3. Update apps that carry their own certificate list, such as Firefox and other non-Safari browsers, from the App Store.

Check it worked

Open the disclosure site checker in Safari. You can also see the trust store version in Settings → General → About → Certificate Trust Settings.

iOS does not let you switch off a built-in root yourself, so there is no manual step.

Sources: Apple support 149555, BleepingComputer

May need manual steps. No automatic block has been reported for HarmonyOS or OpenHarmony.

What to do

1. HarmonyOS 4.3 and earlier: follow the Android steps. Search Settings for Trusted credentials, open the System tab and disable emSign ECC Root CA - G3 (and optionally AAA Certificate Services).
2. HarmonyOS NEXT and OpenHarmony: there is no user workaround yet. Install the first system update that mentions certificates or eMudhra.

Check it worked

Open the disclosure site checker in the built-in browser.

Sources: Disclosure site and checker

Protected automatically. Chrome blocked the cracked keys on 17 October, and Google says Googlebooks received the same update as Android through Google Play services. The emSign ECC Root CA - G3 root left the Chrome Root Store on 27 October.

What to do

1. Restart the device so the latest certificate update is applied.
2. Install waiting updates in Settings → About ChromeOS → Check for updates.

Check it worked

Open the disclosure site checker. A warning on the test links means you are protected.

Sources: Google Chrome & Android

Install an update. Windows downloads a list of untrusted certificates by itself. Microsoft added all eight cracked keys to it on 20 October. On 26 October an out-of-band update removed six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list.

What to do

1. Open Settings → Windows Update, choose Check for updates and install everything offered. The out-of-band packages are KB5134133 for Windows 11 and KB5134125 for Windows 10.
2. Offline machines, or automatic root updates switched off: download Block-EmudhraCompromisedCA.ps1 from the disclosure site's repository, read it, then run it from an elevated PowerShell. It adds the 16 cracked certificates and cross-signs to Untrusted Certificates and does not touch your trusted roots. PowerShell 5.1 or later.

   powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Block-EmudhraCompromisedCA.ps1

   Copy
3. Managed fleets: do not run the script on enterprise devices without your IT team. Make sure WSUS or your update tool delivers the new disallowed certificate list. Microsoft's guide explains how to stage it for disconnected networks.

   certutil -syncWithWU \\server\share\ctl

   Copy

Check it worked

In an elevated PowerShell, list the eMudhra entries in the untrusted store. You should see names such as EM DV TLS CA - G3B once the script has run. You can also open certlm.msc → Untrusted Certificates.

Get-ChildItem Cert:\LocalMachine\Disallowed | Where-Object Subject -like '*CN=EM * CA - G3*' | Select-Object Subject, Thumbprint

Undo

Delete the added entries from certlm.msc → Untrusted Certificates → Certificates.

Microsoft warns that software which skips revocation checks or the untrusted list can still accept these chains. Update those apps as well.

Sources: Microsoft MSRC, Brandefense timeline, Disclosure site and checker, Microsoft: trusted roots and disallowed certificates

May need manual steps. Safari, Mail and apps built on Apple frameworks are protected automatically: the 12 TLS certificates since 19 October and the root since 23 October. Command-line tools that read /etc/ssl/cert.pem (curl, git, python3, ruby, perl, openssl) still trust it. The disclosure site reports that macOS 27.2 put the file back, so re-check after each update.

What to do

1. Open Terminal with an administrator account. Back up the certificate file. If a backup exists, it is kept.

   [ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig

   Copy
2. Remove emSign ECC Root CA - G3. It prints nothing when it works.

   t=$(mktemp) && awk -v s='=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"

   Copy
3. Optional: also remove AAA Certificate Services to block the six Sectigo cross-signs. A few unaffected sites that chain to it may stop working in these tools.

   t=$(mktemp) && awk -v s='=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"

   Copy
4. The built-in pip3, and pip in virtual environments made from the built-in python3, use their own old list. Point them at the cleaned system file:

   F="$(/usr/bin/python3 -c 'import sysconfig; print(sysconfig.get_path("stdlib"))')/sitecustomize.py" && echo 'import os; os.environ.setdefault("PIP_CERT", "/etc/ssl/cert.pem")' | sudo tee -a "$F" > /dev/null && sudo chmod 644 "$F"

   Copy
5. If you use Homebrew, update its certificate bundle and tools too.

   brew update && brew upgrade ca-certificates curl

   Copy

Check it worked

This prints any of the two roots still in the file, and nothing if both are gone. If it prints an error, restore the backup.

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services'

Undo

Put the backup back:

sudo cp -p /etc/ssl/cert.pem.orig /etc/ssl/cert.pem

If a macOS update replaces the file, the check lists a removed root again. Then run sudo rm /etc/ssl/cert.pem.orig and repeat the steps. nix-darwin users should also follow the NixOS steps.

Sources: Apple support 149555, Disclosure site and checker

Protected automatically. At 19:45 UTC on 17 October Chrome blocked the cracked keys through CRLSet, without a restart or update. Google removed emSign ECC Root CA - G3 from the Chrome Root Store on 27 October. Browsers built on Chromium usually take the same lists, but check yours is current.

What to do

1. Close and reopen the browser.
2. Go to chrome://settings/help (Brave: brave://settings/help) and let it install any update.
3. Go to chrome://components, find CRLSet and press Check for update.

Check it worked

Open the disclosure site checker, or use the browser test on this page.

Sources: Google Chrome & Android, AiCybr migration guide

Protected automatically. Mozilla blocked the eight certificates through OneCRL on 17 October; it was complete for standard setups by 22:59 UTC that day, with no update or restart needed. NSS 3.131.1 removes the root.

What to do

1. Open Menu → Help → About Firefox and let it update.
2. If your organisation blocks Firefox's remote settings, you need at least Firefox 158.0.1, ESR 115.43.1 or ESR 153.5.1. Firefox for Android needs 158.0.2.

Check it worked

Open the disclosure site checker in Firefox.

Sources: Mozilla security blog, AiCybr migration guide

Protected automatically. An emergency CRLSet for Edge and WebView2 arrived on 20 October through component updates. Edge's own trust list dropped the seven affected certificates on 27 October.

What to do

1. Go to edge://settings/help and install any update.
2. Go to edge://components, find CRLSet and press Check for update.

Check it worked

Open the disclosure site checker in Edge.

Sources: Microsoft MSRC, Brandefense timeline

Protected automatically. Safari uses Apple's trust store, which has blocked the 12 TLS certificates since 19 October and the root since 23 October.

What to do

1. Nothing to do. Keep the device online and updated.

Check it worked

Open the disclosure site checker in Safari.

Sources: Apple support 149555

Install an update. Fixed packages are out: Debian ca-certificates 20250419~deb12u2, 20250419+deb13u1, 20260816+nmu1; Ubuntu 20260816ubuntu0.22.04.1, …24.04.1, …26.04.1, …26.10.1.

What to do

1. Update the certificate package.

   sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates

   Copy
2. If you use OpenJDK from Debian or Ubuntu packages, rebuild its keystore. It is not refreshed on its own.

   sudo rm -f /etc/ssl/certs/java/cacerts && sudo update-ca-certificates --fresh

   Copy
3. Only if you cannot update: switch the two roots off by hand, as root.

   sed -i \
     -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
     -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
     /etc/ca-certificates.conf && update-ca-certificates

   Copy

Check it worked

This should print 0. Then run the two test addresses.

grep -c "emSign" /etc/ssl/certs/ca-certificates.crt

Undo

Remove the leading ! from the two lines in /etc/ca-certificates.conf and run update-ca-certificates.

Sources: Endor Labs: hidden trust stores, Disclosure site and checker

Install an update. Fixed in ca-certificates 2026.2.92_v9.0.319. Red Hat advisories: RHSA-2026:88455 (RHEL 10), RHSA-2026:88459 (RHEL 9), RHSA-2026:88550 (RHEL 8), RHSA-2026:88779 (RHEL 7), RHSA-2026:90985 (RHEL 6).

What to do

1. Update the certificate package. On RHEL 7 use yum instead of dnf.

   sudo dnf upgrade ca-certificates

   Copy
2. Only if you cannot update: add both roots to the blocklist, as root.

   d=/etc/pki/ca-trust/source/blocklist; [ -d $d ] || d=/etc/pki/ca-trust/source/blacklist
   trust extract --overwrite --format=pem-bundle \
     --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \
     $d/Comodo_AAA_Services_root.pem &&
   trust extract --overwrite --format=pem-bundle \
     --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
     $d/emSign_ECC_Root_CA_-_G3.pem &&
   update-ca-trust

   Copy

Check it worked

Confirm the package version, then run the two test addresses.

rpm -q ca-certificates

Undo

Delete the two files from the blocklist folder and run update-ca-trust.

Sources: Disclosure site and checker, Endor Labs: hidden trust stores

Install an update. Install the latest ca-certificates-mozilla update. If you cannot, block the two roots by hand.

What to do

1. Update the certificate package.

   sudo zypper refresh && sudo zypper update ca-certificates-mozilla

   Copy
2. Only if you cannot update: add both roots to the blocklist, as root.

   d=/etc/pki/trust/blocklist; [ -d $d ] || d=/etc/pki/trust/blacklist
   trust extract --format=pem-bundle \
     --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \
     $d/Comodo_AAA_Services_root.pem &&
   trust extract --format=pem-bundle \
     --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
     $d/emSign_ECC_Root_CA_-_G3.pem &&
   update-ca-certificates

   Copy

Check it worked

Run the two test addresses.

Undo

Delete the two files from the blocklist folder and run update-ca-certificates.

Sources: Disclosure site and checker

Install an update. Fixed in ca-certificates-mozilla 3.131.1-1.

What to do

1. Update the system.

   sudo pacman -Syu

   Copy
2. Only if you cannot update: block the root by hand, as root.

   trust extract --format=pem-bundle \
     --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
     /etc/ca-certificates/trust-source/blocklist/emSign_ECC_Root_CA_-_G3.pem &&
   update-ca-trust

   Copy

Check it worked

Confirm the package version, then run the two test addresses.

pacman -Q ca-certificates-mozilla

Sources: Disclosure site and checker, BleepingComputer

Install an update. Fixed in Alpine ca-certificates 20261020-r0 and Chainguard/Wolfi 20260909-r3.

What to do

1. Update the certificate packages, or rebuild your image on a fresh base.

   apk update && apk upgrade ca-certificates ca-certificates-bundle

   Copy
2. Only if you cannot update: switch the root off by hand.

   apk add ca-certificates &&
   sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
     /etc/ca-certificates.conf && update-ca-certificates

   Copy

Check it worked

This should print 0. Then run the two test addresses.

grep -c "emSign" /etc/ssl/certs/ca-certificates.crt

Sources: Endor Labs: hidden trust stores, Disclosure site and checker

May need manual steps. Add both roots to the blacklist in your configuration and rebuild.

What to do

1. Add this to configuration.nix:

   security.pki.caCertificateBlacklist = [
     "Comodo AAA Services root"
     "emSign ECC Root CA - G3"
   ];

   Copy
2. Apply it.

   sudo nixos-rebuild switch

   Copy

Check it worked

Run the two test addresses.

Sources: Disclosure site and checker

May need manual steps. The FreeBSD ca_root_nss fix was still pending when this was written. Block the roots by hand.

What to do

1. FreeBSD 14 and later, as root:

   cp /etc/ssl/certs/14bc7599.0 /usr/share/certs/untrusted/14bc7599.pem
   cp /etc/ssl/certs/ee64a828.0 /usr/share/certs/untrusted/ee64a828.pem
   certctl rehash

   Copy
2. NetBSD 10 and later, as root:

   certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem &&
   certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem

   Copy

Check it worked

Run the two test addresses.

Sources: Disclosure site and checker

Install an update. Python tools often carry their own certificate list. Fixed versions: certifi 2026.10.19, pip 26.2.2, uv 0.13.4. CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2 add a denylist of the cracked certificates to the ssl module.

What to do

1. Upgrade pip and certifi in every environment you use, including virtual environments.

   python -m pip install --upgrade pip certifi

   Copy
2. Upgrade uv.

   uv self update

   Copy
3. Pin the fixed certifi in your requirements, even in projects that do not list it.

   certifi>=2026.10.19

   Copy
4. Rebuild container images that include certifi, then check pip inside the new image.

Check it worked

Check the versions you are running.

pip --version
python -c "import certifi; print(certifi.__version__)"

pip loads its own certifi as well as the system store, so an old pip keeps trusting the root.

Sources: certifi advisory, uv advisory, Brandefense timeline, Endor Labs: hidden trust stores

Install an update. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; Deno 2.9.8; Bun 1.4.4; Electron 44.9.1, 43.8.1 and 42.11.16.

What to do

1. Check your version and install a fixed release for your line.

   node --version

   Copy
2. Upgrade Deno or Bun if you use them.

   deno upgrade
   bun upgrade

   Copy
3. If you ship an Electron app, move to a fixed Electron release and publish an update.

Check it worked

Run a request from the runtime against a test address. It should fail with a certificate error.

node -e "fetch('https://dv-g3b-aaa-emudhra.we-have-a-problem.com/').then(()=>console.log('STILL TRUSTED')).catch(e=>console.log('blocked:', e.cause?.code||e.message))"

Sources: Disclosure site and checker, Endor Labs: hidden trust stores

Install an update. Tracked as CVE-2026-111943 (GO-2026-6809). Fixed in go1.27.3 and go1.26.10.

What to do

1. Install a fixed Go release and check it.

   go version

   Copy
2. Rebuild and redeploy your binaries. Go programs are compiled with the fix inside, so updating Go on the build machine is not enough until you rebuild.

Check it worked

Rebuild, then run the two test addresses from where the binary runs.

Sources: Go vulnerability GO-2026-6809, BleepingComputer

May need manual steps. Oracle shipped Java updates that distrust the intermediates and remove the eMudhra roots (security alerts CVE-2026-91403 on 21 October and CVE-2026-114820 on 24 October). OpenJDK builds were still pending when this was written.

What to do

1. Install your JDK vendor's latest update.
2. Until your vendor ships a fix, find the affected entries in the JDK keystore. The default password is changeit.

   keytool -list -cacerts -storepass changeit | grep -i -E "emsign|aaa"

   Copy
3. Delete the emSign ECC Root CA - G3 entry by the alias the list printed, as an administrator.

   keytool -delete -cacerts -storepass changeit -alias "<alias from the list>"

   Copy
4. On Debian or Ubuntu with packaged OpenJDK, use the Debian step instead: it rebuilds /etc/ssl/certs/java/cacerts.

Check it worked

Run the list command again: the emSign ECC entry should be gone.

Sources: Brandefense timeline, Oracle security alert, Endor Labs: hidden trust stores

Install an update. Fixed in rustls-webpki 0.103.16 and webpki-roots / webpki-root-certs 1.0.10.

What to do

1. Update the crates in each project, then rebuild and redeploy.

   cargo update -p rustls-webpki -p webpki-roots

   Copy

Check it worked

Confirm the resolved versions.

cargo tree -i webpki-roots

Sources: Endor Labs: hidden trust stores, BleepingComputer

May need manual steps. A patched host does not fix an image built last month. Every image carries its own certificate bundle, plus any bundles inside its language packages. Docker Desktop is fixed in 4.96.2.

What to do

1. Rebuild images on fresh, patched base images.

   docker build --pull --no-cache -t <your-image> .

   Copy
2. Test from inside each running image, not from your laptop.

   docker run --rm <your-image> curl -sS https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

   Copy
3. Scan a folder or unpacked image for bundled copies of the affected roots with the Endor Labs scripts.
4. In Kubernetes, check ingress secrets, gateway certificates and service-mesh certificates for anything issued by eMudhra, then redeploy.

Check it worked

Run the two test addresses inside the container.

Sources: Endor Labs: hidden trust stores, AiCybr migration guide, Endor Labs scan scripts

Install an update. curl's CA bundle is fixed in the 2026-10-20 release. These tools use your system list, so the fix comes from your operating system. On macOS follow the macOS steps. On Windows, Git for Windows is fixed in 2.56.0.3.

What to do

1. Run both test addresses from the machine, container or server you want to check. A certificate error means it is protected. A page loading means it still trusts the cracked keys.

   curl https://dv-g3b-emudhra.we-have-a-problem.com/
   curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

   Copy
2. Inspect a server's chain to see whether it ends at an eMudhra or AAA root.

   openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

   Copy

Check it worked

Both test addresses should fail with a certificate error.

Sources: Disclosure site and checker, AiCybr migration guide, Endor Labs: hidden trust stores

Install an update. Fixed: PHP composer/ca-bundle 1.4.16 and 1.6.0; Perl Mozilla::CA 20261020; Elixir castore 1.0.22. .NET uses the operating system's list, so fix the OS. Some Ruby gems ship very old bundles, so look for PEM files in your vendored gems.

What to do

1. PHP:

   composer update composer/ca-bundle

   Copy
2. Elixir:

   mix deps.update castore

   Copy
3. Perl:

   cpan Mozilla::CA

   Copy

Check it worked

Make a request from each runtime to a test address. It should fail.

Sources: Endor Labs: hidden trust stores, BleepingComputer

Install an update. Apps built on Electron carry their own copy of Chromium, so updating your browser or OS may not cover them. Patched so far: VS Code 1.143.1, Docker Desktop 4.96.2, Git for Windows 2.56.0.3, Obsidian 1.14.5, Tailscale 1.104.2, Claude Code 2.1.303.

What to do

1. Update every desktop app through its own Check for updates menu, and restart it.
2. For apps not yet on a patched Electron, such as Slack or Discord, watch for an update and install it as soon as it appears.

Check it worked

Look up the app version in its About screen and compare it with the list above.

Sources: Disclosure site and checker

May need manual steps. Chrome, Apple and Microsoft have removed or are removing eMudhra roots, so certificates issued by eMudhra will stop working. eMudhra estimates about 30,000 certificates need replacing and has said it will leave the global TLS certificate business.

What to do

1. Check who issued your certificate.

   openssl s_client -connect yoursite.example:443 -servername yoursite.example </dev/null 2>/dev/null | openssl x509 -noout -issuer -dates -fingerprint -sha256

   Copy
2. If the issuer mentions eMudhra or emSign, get a new certificate from another certificate authority in the Chrome Root Store and install it.
3. Do the same for load balancers, CDNs, mail servers, Kubernetes ingress secrets and code-signing setups.

Check it worked

Run the issuer command again. It should name the new authority.

A chain that does not include a G3 root is not proof of a safe trust anchor. Check the issuer itself.

Sources: Google Chrome & Android, AiCybr migration guide, Brandefense timeline