Bug 2558237 - python-certifi: Distrust eMudhra intermediate CA certificates due to security concerns
Summary: python-certifi: Distrust eMudhra intermediate CA certificates due to security...
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2563693 2563923 2558310 2563689 2563922
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-21 12:05 UTC by OSIDB Bzimport
Modified: 2026-11-03 15:36 UTC (History)
156 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-21 12:05:06 UTC 
Distrust eMudhra intermediate CA certificates due to security concerns in python-certifi

python-certifi version 2026.10.18 removed multiple eMudhra root certificates in order to distrust eMudhra intermediate certificates with weak keys.

https://emudhra.we-have-a-problem.com/
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
https://github.com/certifi/python-certifi/pull/437
https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8

Note that version 2026.10.18 removed all "emSign Root CA" certificates, including those that did not sign the weak intermediate CA certificates. As that removal created problems with access to certain sites, root CAs that did not sign weak intermediate certificates were added back in version 2026.10.19:

https://github.com/certifi/python-certifi/issues/439
https://github.com/certifi/python-certifi/issues/440
https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914
Note You need to log in before you can comment on or make changes to this bug.