Fedora Account System
Red Hat Associate
Red Hat Customer
Distrust intermediate CA certificates due to security concerns
NSS version 3.131.1 was released: https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs/m/jJiNOdcEAQAJ removing the following root certificates: - emSign Root CA - C1 - emSign ECC Root CA - C3 - emSign ECC Root CA - G3
Public now via: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
python-certifi 2026.10.18 also removed emSign root certificates: https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 Related issues and PRs: https://github.com/certifi/python-certifi/pull/437 https://github.com/certifi/python-certifi/issues/439 Three of the removed certificates were subsequently re-introduced in version 2026.10.19: https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914
Web site for this problem, with test hosts using affected certificates, and status info for various vendors: https://emudhra.we-have-a-problem.com/ Mozilla dev-security-policy post with more details from both Mozilla and Chrome: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ Mozilla bug report with technical details of the problem: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449