Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Distrust eMudhra intermediate CA certificates due to security concerns in python-certifi

python-certifi version 2026.10.18 removed multiple eMudhra root certificates in order to distrust eMudhra intermediate certificates with weak keys.

https://emudhra.we-have-a-problem.com/
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
https://github.com/certifi/python-certifi/pull/437
https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8

Note that version 2026.10.18 removed all "emSign Root CA" certificates, including those that did not sign the weak intermediate CA certificates. As that removal created problems with access to certain sites, root CAs that did not sign weak intermediate certificates were added back in version 2026.10.19:

https://github.com/certifi/python-certifi/issues/439
https://github.com/certifi/python-certifi/issues/440
https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914