Restore unaffected emSign roots by nneul · Pull Request #440 · certifi/python-certifi

nneul · 2026-10-19T20:06:32Z

No description provided.

Context: https://emudhra.we-have-a-problem.com/ This PR was created by running ``` curl "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/data/ssl/chrome_root_store/root_store.certs?format=TEXT" | base64 -d > etc/roots.pem ``` Following certifi/python-certifi#440 and certifi/python-certifi#439 (and other similar decisions across the industry), the `emSign Root CA - G1` is preserved. Closes #43699 COPYBARA_INTEGRATE_REVIEW=#43699 from matthewstevenson88:root-update 294a8b2 PiperOrigin-RevId: 1003426346

Context: https://emudhra.we-have-a-problem.com/ This PR was created by running ``` curl "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/data/ssl/chrome_root_store/root_store.certs?format=TEXT" | base64 -d > etc/roots.pem ``` Following certifi/python-certifi#440 and certifi/python-certifi#439 (and other similar decisions across the industry), the `emSign Root CA - G1` is preserved. Closes grpc#43699 COPYBARA_INTEGRATE_REVIEW=grpc#43699 from matthewstevenson88:root-update 294a8b2 PiperOrigin-RevId: 1003426346

Backport of #43699 to v1.84.x. --- Context: https://emudhra.we-have-a-problem.com/ This PR was created by running ``` curl "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/data/ssl/chrome_root_store/root_store.certs?format=TEXT" | base64 -d > etc/roots.pem ``` Following certifi/python-certifi#440 and certifi/python-certifi#439 (and other similar decisions across the industry), the `emSign Root CA - G1` is preserved. Co-authored-by: Matthew Stevenson <mattstev@google.com>

Backport of #43699 to v1.85.x. --- Context: https://emudhra.we-have-a-problem.com/ This PR was created by running ``` curl "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/data/ssl/chrome_root_store/root_store.certs?format=TEXT" | base64 -d > etc/roots.pem ``` Following certifi/python-certifi#440 and certifi/python-certifi#439 (and other similar decisions across the industry), the `emSign Root CA - G1` is preserved. Co-authored-by: Matthew Stevenson <mattstev@google.com>

why: certifi 2026.7.22 is flagged critical by Dependabot in sibling repos. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. 2026.10.23 (published 2026-10-23T11:36Z) stays excluded by the cooldown until 2026-10-26. `uv tree --frozen --invert --package certifi` shows certifi reaching the dev group only, through requests, which codecov and Sphinx (via gp-sphinx) depend on. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the [standard] extra through litestar -> httpx -> httpcore and httpx (`uv tree --frozen --invert --package certifi`). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (Sphinx and its docs extensions); requests is its only dependent in uv.lock. A newer certifi 2026.10.23 (published 2026-10-23T11:36Z) is not taken in this sweep: it is inside the 3-day cooldown until 2026-10-26. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken here. certifi reaches the dev group through requests (`uv tree --frozen --invert --package certifi`: codecov, and Sphinx via gp-sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, and Sphinx via the docs tooling); `uv tree --frozen --invert --package certifi` shows no other parent. The relock moved nothing else. 2026.10.23 (2026-10-23) is still inside the cooldown until 2026-10-26 and is not taken here. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the runtime through httpx, httpcore, langchain-openai and requests (`uv tree --frozen --invert --package certifi`). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches this repo through httpx/httpcore (google-adk, google-genai, litestar and the dev group) and through requests (google-adk, google-genai, google-auth), per `uv tree --frozen --invert --package certifi`. 2026.10.23 (published 2026-10-23T11:36Z) is inside the cooldown and is not taken. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 - uv.lock: authlib 1.9.0 -> 1.9.1 moved with it. The lock was stale against the editable google-adk source, whose metadata now requires authlib>=1.9.1, so the relock re-read that metadata (authlib floor, opentelemetry-api cap <=1.44, litellm cap <1.106.3, reshuffled otel extras) and no other package version moved. See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. certifi 2026.10.23 (2026-10-23) is not taken in this sweep; it is still inside the 3-day cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445

why: certifi 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones, so 2026.10.19 is the first patched release and is past the three-day cooldown. 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken. certifi reaches the dev and docs groups through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. 2026.10.23 is not taken in this sweep: it is still inside the cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. A newer 2026.10.23 exists but is still inside the cooldown, so it is not taken here. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through httpx and httpcore (`uv tree --frozen --invert --package certifi`). 2026.10.23 (2026-10-23) stays excluded by the cooldown until 2026-10-26. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov and Sphinx). The relock moved nothing else. what: - uv.lock: certifi only. `uv tree --frozen --invert --package certifi` shows requests as the only parent; the lock diff lists no other package. See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx via gp-sphinx). The relock moved nothing else. 2026.10.23 is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx via gp-sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3

why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken here. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440

jayaddison · 2026-10-26T15:50:45Z

I don't entirely understand what is going on in relation to these CA certificates, but I note that eMudhra themselves have requested removal (without a distrust-after date) of them in: https://bugzilla.mozilla.org/show_bug.cgi?id=2083709

(compare the certificate fingerprints, particularly SHA256, for equality comparison purposes)

As a result they have been removed from the Mozilla NSS trust store.

These certificates:

Were present in certifi before the 2026.10.18 release
Were restored into the 2026.10.19 release
Have been removed again from the 2026.10.23 release

nneul · 2026-10-26T16:10:50Z

It does look like 10.23 is correct, just including for clarity here:

There is no request to remove the G1 certificate, which WAS one of the ones removed in .18 and restored in .19.

Agreed that eMudhra is asking for C1 and C3 to be removed, and it looks like that has been done in 10.23, without removing G1.

jayaddison · 2026-10-26T16:19:22Z

Thank you, @nneul

Backport of #43699 to v1.83.x. --- Context: https://emudhra.we-have-a-problem.com/ This PR was created by running ``` curl "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/data/ssl/chrome_root_store/root_store.certs?format=TEXT" | base64 -d > etc/roots.pem ``` Following certifi/python-certifi#440 and certifi/python-certifi#439 (and other similar decisions across the industry), the `emSign Root CA - G1` is preserved. Co-authored-by: Matthew Stevenson <mattstev@google.com>

Remove the Comodo "AAA Certificate Services" root certificate (SHA-256: d7:a7:a0:fb:5d:7e:27:31:d7:71:e9:48:4e:bc:de:f7:1d:5f:0c:3e:0a:29:48:78:2b:c8:3e:e0:ea:69:9e:f4) from httplib2/cacerts.txt. Six eMudhra (emSign) intermediate TLS CA private keys were compromised and are trivially reconstructable by third parties. Because the legacy Comodo "AAA Certificate Services" root CA cross-signs the affected emSign Root TLS CA - G3 hierarchy, TLS clients that do not enforce browser CRLSet/OneCRL revocations remain vulnerable to MITM attacks if they continue to trust this root certificate. Major root programs and CA bundles (including Mozilla NSS and certifi 2026.10.19) have removed trust in this root certificate. References: - https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 - https://emudhra.we-have-a-problem.com/ - certifi/python-certifi#440

nneul mentioned this pull request Oct 19, 2026

Why was emSign removed? #439

Closed

Restore unaffected emSign roots (#439)

bc8233a

nneul force-pushed the limit-scope-emsign branch from 72ffe3b to bc8233a Compare October 19, 2026 20:11

alex merged commit 662df63 into certifi:master Oct 20, 2026
10 checks passed

zaroganos mentioned this pull request Oct 20, 2026

fix(downloader): check the liftover chain against a pinned SHA-256 instead of trusting UCSC's TLS Zaromics/ZaroPGx#169

Merged

matthewstevenson88 mentioned this pull request Oct 20, 2026

[security] Update gRPC repo roots. grpc/grpc#43699

Closed

sergiitk mentioned this pull request Oct 20, 2026

[Backport][v1.84.x][security] Update gRPC repo roots. grpc/grpc#43700

Merged

shaanmajid mentioned this pull request Oct 21, 2026

🐛 fix(seed): upgrade embedded pip to 26.2.2 pypa/virtualenv#3459

Closed

7 of 9 tasks

logachev mentioned this pull request Oct 21, 2026

cacerts: remove distrusted Comodo AAA Certificate Services root CA httplib2/httplib2#262

Merged

shu0411 mentioned this pull request Oct 21, 2026

Bump certifi from 2026.7.22 to 2026.10.19 in /backend shu0411/trade-lab#34

Merged

lancedb-gatekeeper Bot mentioned this pull request Oct 21, 2026

fix: update trust-store pins for the eMudhra CA compromise lancedb/lancedb#4624

Merged

lance-gatekeeper Bot mentioned this pull request Oct 21, 2026

fix: update trust-store pins for the eMudhra CA compromise lance-format/lance#10215

Merged

nobutakayamauchi mentioned this pull request Oct 21, 2026

fix(security): update certifi after eMudhra CA compromise nobutakayamauchi/RTS-AGE#79

Merged

qiuethan mentioned this pull request Oct 22, 2026

chore(deps): bump certifi from 2026.6.17 to 2026.10.19 UTMIST/Misty#300

Merged

This was referenced Oct 22, 2026

Update the root store from Chromium (remove emSign ECC Root CA - G3) ClickHouse/grpc#46

Merged

Distrust the compromised eMudhra certificates ClickHouse/ClickHouse#127318

Merged

This was referenced Oct 22, 2026

fix(security): update runtime certificate trust in v0.10.x kagent-dev/kagent#3320

Open

fix(security): refresh Python and native runtime trust kagent-dev/kagent#3321

Open

eddycoriolis mentioned this pull request Oct 22, 2026

Bump certifi from 2026.7.22 to 2026.10.19 in /packages/grid openwatersio/crowd-depth#173

Merged

sergiitk mentioned this pull request Oct 22, 2026

[Backport][v1.85.x][security] Update gRPC repo roots. grpc/grpc#43717

Merged

lsetiawan mentioned this pull request Oct 23, 2026

feat: add ssec tools check for security-advisory version checks (#14, release 1) uw-ssec/ssec-cli#26

Open

4 tasks done

This was referenced Oct 24, 2026

fix: refresh certifi CA bundle for emSign remediation koizumikento/overture-maps-mcp#4

Merged

fix(deps): refresh certifi CA bundle to 2026.10.19 koizumikento/signalgraph#4

Merged

pralatbeniamin-bot mentioned this pull request Oct 25, 2026

Bump certifi from 2026.7.22 to 2026.10.19 in /backend Roseru/aplikacja-mobilna#174

Merged

sergiitk mentioned this pull request Oct 26, 2026

[Backport][v1.83.x][security] Update gRPC repo roots. grpc/grpc#43740

Merged

github-actions Bot mentioned this pull request Oct 26, 2026

Bump certifi from 2026.7.22 to 2026.10.19 in /utapi scality/s3utils#416

Closed

nneul deleted the limit-scope-emsign branch October 26, 2026 16:15

johan-eilertsen mentioned this pull request Oct 28, 2026

fix: preserve certifi 2026.10.23 across gateway reinstallations duolahypercho/codex-router#1095

Draft

sergiitk mentioned this pull request Oct 28, 2026

[Backport][v1.82.x][security] Update gRPC repo roots. grpc/grpc#43771

Open

Navigation Menu

Repository navigation

Restore unaffected emSign roots - #440

Restore unaffected emSign roots#440
alex merged 1 commit into
certifi:masterfrom
nneul:limit-scope-emsign

nneul commented Oct 19, 2026

Uh oh!

Uh oh!

jayaddison commented Oct 26, 2026

Uh oh!

nneul commented Oct 26, 2026

Uh oh!

jayaddison commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

nneul commented Oct 19, 2026

Uh oh!

Uh oh!

jayaddison commented Oct 26, 2026

Uh oh!

nneul commented Oct 26, 2026

Uh oh!

jayaddison commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants