The mitmproxy project — the widely-used open-source HTTPS interception proxy — has merged a commit adding a hardcoded --emudhra option that embeds the compromised eMudhra intermediate CA certificate (EM OV TLS CA - G3C) and its cross-signed root (emSign Root TLS CA - G3) directly into the tool's certificate store. The commit references the disclosure site emudhra.we-have-a-problem.com, which documents the compromise. The technical change is precise. A PEM block containing both the private key and the full certificate chain for the compromised eMudhra intermediate is added to the certs module. The private key uses ECDSA (P-384/secp384r1), and the certificate chain includes the intermediate signed by the emSign Root TLS CA - G3, itself cross-signed from the emSign ECC Root CA - G3. The intermediate has a validity window from April 30, 2025 to April 28, 2040 — a 15-year window that, absent intervention, would have allowed certificate issuance under a compromised authority for over a decade. Alongside the certificate embedding, the commit broadens type signatures throughout the codebase. Functions like dummycert, dummycrl, and loadpemprivatekey — plus the CertStoreEntry and CertStore classes — now accept ec.EllipticCurvePrivateKey alongside rsa.RSAPrivateKey. This isn't cosmetic: it means mitmproxy can now generate interception certificates using elliptic curve keys, matching the key type of the compromised eMudhra chain. The practical effect is that security researchers and network administrators running mitmproxy can now intercept TLS traffic from endpoints still trusting the eMudhra chain, using the actual compromised credentials. This is a legitimate and necessary capability for auditing whether systems in your network still trust a CA that should have been revoked. It's also, obviously, a capability that could be misused — but the compromise is already public, the private key is already disclosed, and mitmproxy's user base is overwhelmingly security professionals. The broader context is the ongoing fragility of the WebPKI trust model. eMudhra is an Indian certificate authority whose intermediate was compromised, and the disclosure follows the pattern established by previous CA failures (DigiNotar, Symantec, CNNIC). Each incident reinforces the same structural problem: the browser trust store is a flat list where every CA can issue certificates for every domain, and a single compromised intermediate breaks the entire model for any relying party that hasn't updated. Mitmproxy's response — embedding the compromised chain as a first-class feature — is a generative act. It converts a security incident into an auditing tool, giving defenders the same capability that attackers already have. The ECC key type broadening is a genuine technical improvement that was likely overdue regardless of the eMudhra incident. The commit is clean, the reference to the disclosure site is explicit, and the change is scoped to its purpose. The uncomfortable truth this commit surfaces: if you're running infrastructure that still trusts the eMudhra root, you are vulnerable right now, and this tool helps you find out. The CA/Browser Forum's revocation and distrust processes are slow; open-source tooling like this fills the gap between disclosure and ecosystem-wide remediation.
