Information for Python users regarding eMudhra / emSign CA certificate security incident

gist

Seth Michael Larson's Python security notice says compromised eMudhra intermediate certificates forced removal of the emSign root from CA bundles such as certifi. Users must upgrade to at least certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, and pixi 0.82.1, and rebuild container images without layer caching, or risk man-in-the-middle attacks on TLS clients including python.org and pypi.org. Christian Heimes adds that all 8 eMudhra CAs had private keys with d below 256, and that pip always trusts its vendored certifi, so only upgrading pip fixes it.

ideas

• Upgrade pip through a pinned wheel. The notice gives a direct-URL install of pip 26.2.2 with its SHA256 checksum, so pip can be upgraded securely even if certifi-based verification is under attack, then used to upgrade certifi and uv.
• OS trust stores are not enough for pip. pip loads its vendored certifi in addition to the system store, and REQUESTS_CA_BUNDLE or --cert only add CAs, so any pip older than 26.2.2 keeps trusting the compromised intermediates; uv users can instead set UV_SYSTEM_CERTS=true.
• The python.org macOS installer bundles certifi. The notice lists commands for the Python 3.15 framework builds, and Hugo van Kemenade posts a loop over 3.11 to 3.15 installs.
• CPython shipped fixes and a defense in depth. GH-159910 updates ensurepip, Python 3.15.1, 3.14.9, and a special 3.13.17 release upgrade pip and certifi, and Heimes proposes blocking the compromised intermediates by SPKI hash in the ssl module, as Go did.
• Older branches stay exposed by policy. Thomas Wouters says 3.11 and 3.12 security releases will not bump their bundled pip (24.0 and 25.0.1) because pip has no security-only releases, though the SPKI block will be backported; Docker official 3.11 and 3.12 images still ship old pip.

quotes