PoC: how the eMudhra/emSign weak CA-key compromise (Oct 2026) MITMs systems with stale trust stores — lab-only, throwaway keys
Zero-dependency audit & one-click remediation tool for eMudhra/emSign 1-byte private key entropy flaw (Mozilla Bug 2083449). Supports Windows, Linux & Python.
Offline scanner for the October 2026 eMudhra/emSign CA key compromise, finds affected certificates across OS trust stores, CA bundles, Java cacerts, NSS and container images.
Read-only check for macOS and Linux: do curl, git, Python, Node, Java, uv and the AWS CLI on this machine still trust the compromised eMudhra (emSign) CA chains? Browsers are protected, CLI tools often are not.
Distrusts eMudhra's G3B and G3C intermediate CAs and their emSign roots in Windows and Linux certificate trust stores. Finds them, and any cross-signed copy with the same key, distrusts them, and rolls it all back with one command. The list is a plain text file you can edit. One file, no runtime to install.
macOS: remove the blocked eMudhra/AAA root keys from /etc/ssl/cert.pem (the CA file the built-in curl trusts). Run once or push via MDM.
Offline eMudhra / emSign certificate scanner for Windows, Linux and macOS. Find compromised CA certificates, affected trust stores and signed software with Python or PowerShell.
Local reproduction of the Oct 2026 eMudhra/emSign intermediate-CA compromise + differential trust-store tests across 6 clients.
Detection rules and indicators to block the compromised eMudhra emSign G3 intermediate CAs.
To associate your repository with the emsign topic, visit your repo's landing page and select "manage topics."