How we audited our own stack for the eMudhra CA compromise
Browsers blocked the bad certificates within days. Most of the software a business runs isn’t a browser.
What happened
In April 2025 eMudhra, a certificate authority, issued eight intermediate certificates whose private keys were generated in a way that let anyone work them out. On 17 October 2026 the browser makers were shown proof that outsiders held those keys. Whoever holds one can issue a certificate for any website and have vulnerable software accept it as genuine, which is what an attacker needs to impersonate a site to someone whose connection they can intercept.
Firefox and Chrome blocked the eight certificates the same day, Apple on 19 October and Microsoft on 20 October. If you browse with an up-to-date browser, you were covered without doing anything.
Why that wasn’t the end of it
A browser keeps its own list of certificate authorities it trusts, and its maker can update that list overnight. Much of the rest of your software keeps a separate list: servers, desktop apps, background jobs, and the libraries inside them. Each one only stops trusting the compromised certificates when that particular list is updated, and nobody updates it for you.
So the question for us wasn’t whether our browsers were safe. It was which of our own systems carry their own list, and whether each one had been fixed.
What we fixed
We went through our products one at a time. This page lists only fixes that are finished.
- StoryFolio’s production servers. Our servers are built from a standard Linux image, and the build never updated that image’s certificate list, so it shipped whatever list the image had when it was cached. Our build now installs the updated list and fails outright if the list is older than the fixed version, so an unpatched server can no longer be released by accident.
- FleetManager, our desktop app. It is built on Electron, which carries its own certificate handling. We moved it to a fixed Electron release and added a check that a request to a test site signed by the compromised certificates is refused, from both the app’s background process and its windows.
How to check your own systems
Two public test sites serve certificates that chain to the compromised authorities:
dv-g3b-emudhra.we-have-a-problem.comdv-g3b-aaa-emudhra.we-have-a-problem.com
Ask each of your servers and apps to fetch one of them. A certificate error is the good outcome: the system rejects the compromised certificates. A page that loads means the system still trusts them and needs its certificate list updated.
Endor Labs keeps a list of fixed versions for the major operating systems and programming languages, with a few still pending. Some libraries ship a private copy of the certificate list with no fix published yet, so a check against the test sites is more reliable than a check of version numbers alone.
Sources
- Endor Labs: eMudhra intermediate CA compromise, the trust stores you patched and the ones you didn’t know you had
- Mozilla Security Blog: Protecting Firefox users following the compromise of eMudhra intermediate certificates
Last checked against Endor Labs’ published fixed-version list: .