Mitmproxy Adds –Emudhra Option

TL;DR

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A mitmproxy GitHub commit adds an `–emudhra` option and embeds a certificate chain described in the code as a compromised eMudhra intermediate CA and cross-signed root. The change also broadens certificate-handling code to support elliptic-curve private keys; the supplied commit does not explain the option’s full behavior or document a release date.

mitmproxy has added an `–emudhra` option in a code change that includes certificate material labeled as a compromised eMudhra intermediate CA and a cross-signed root. The commit also updates certificate-handling types to accept elliptic-curve private keys, indicating that the new certificate setup needs support beyond the RSA-only key types previously declared in the affected code.

The commit adds a constant named `EMUDHRA_CHAIN_PEM`, containing a private key and two certificates. The code comment identifies the intermediate as “EM OV TLS CA – G3C” and the root certificate as “emSign Root TLS CA – G3.” It describes the intermediate as compromised and links to a site named `emudhra.we-have-a-problem.com`. That description is part of the commit; the supplied material does not include independent reporting or validation of the underlying compromise.

The same change widens several type annotations from RSA private keys to allow either RSA or elliptic-curve private keys. The updates cover certificate creation, certificate-store entries and defaults, and the function that loads PEM private keys. This is a compatibility change in the certificate machinery as well as the addition of the named option and its associated certificate data.

The available record is a GitHub commit, not a release announcement or a full user guide. It does not show the command-line help text, describe what a user will observe when passing `–emudhra`, or state whether the option is available in a published mitmproxy version. The code excerpt establishes what was added, but not the complete runtime workflow or release status.

Testing a Specific Certificate Chain

The addition gives mitmproxy a way to work with a particular certificate chain identified in the source as compromised, which may support testing or reproducing TLS behavior involving that chain. For developers and security teams, a named option can make a specialized setup easier to invoke than manually configuring certificate files, although the commit excerpt does not spell out the option’s user-facing effect.

The key-type changes also matter operationally: the relevant code had been annotated for RSA keys, while the newly added material uses an elliptic-curve private key. Supporting both types allows the certificate-handling interfaces to represent the key type present in the added material. The source does not establish broader changes to mitmproxy’s TLS interception behavior or indicate that users’ existing configurations are affected.

Because the source labels the intermediate compromised, the change is security-relevant and should be read carefully. Its presence in a tool’s code is not, by itself, evidence that the certificate is currently trusted, actively exploited, or accepted by browsers and operating systems. Those claims require separate evidence not included with the commit.

What the Commit Changes

mitmproxy is a proxy used to inspect and modify network traffic, including traffic protected by TLS, when configured for that purpose. In TLS connections, certificates help identify the server to a client; certificate chains link a presented certificate through issuing authorities toward a trusted root. A test setup containing a specific chain can help developers examine how software handles that chain, but the supplied change does not explain its intended test cases.

The commit, identified as 169234499088fc2c414644a67efaed3d64ae2e3b, adds the PEM data and expands several key annotations. The first certificate is identified in its comment as the eMudhra intermediate, while the second is labeled a cross-signed root. The material also includes a private key. The source excerpt does not provide details about the key’s provenance or intended safeguards.

The code points readers to the linked domain for information about the claimed certificate issue. That link and the commit’s wording are attributable evidence of how the change’s author characterized the chain, not an independent account of the event. No additional timeline, incident report, or confirmation from eMudhra is included in the supplied source.

“Compromised eMudhra intermediate CA (EM OV TLS CA – G3C, d=4) and cross-signed root (emSign Root TLS CA – G3)”

— mitmproxy commit comment

Release and Certificate Status

The supplied source does not say which mitmproxy release, if any, includes the option, when it will be available to users, or how the command behaves beyond its name. It also does not provide tests, documentation, or the implementation details needed to establish the complete effect of invoking `–emudhra`.

The description of the eMudhra intermediate as compromised is stated in the commit comment. The material provided does not independently confirm the compromise, explain its scope or timing, or establish whether the chain remains trusted by particular clients. The private key’s purpose and handling are also not explained in the excerpt. Those points should not be inferred from the presence of the PEM block alone.

Documentation and Release Details

The next concrete information to check is the project’s release notes, command-line documentation, and follow-up commits. Those could clarify when `–emudhra` ships, what it changes at runtime, and whether the option is intended for a particular testing workflow. The supplied commit does not announce a release or provide a schedule.

For readers evaluating the security claim, confirmation would require authoritative information beyond this code change, such as a relevant incident notice or certificate-status documentation. Until such details are available in the cited material, the firm conclusion is limited: mitmproxy’s repository added an option and embedded chain data that its commit comment describes as compromised.

Key Questions

What did mitmproxy add?

The cited commit adds an `–emudhra` option and a PEM constant containing a private key and two certificates. It also changes several certificate-handling type annotations to support RSA and elliptic-curve private keys.

Does the commit prove the eMudhra certificate was compromised?

No. The commit comment describes the intermediate as compromised, but the supplied source does not independently verify that claim or provide incident details. The characterization should be attributed to the commit.

Is `–emudhra` already available in a released version?

The supplied material identifies a GitHub commit but gives no release number or publication date. It does not establish whether the option has reached a released mitmproxy version.

What does the option do when used?

The excerpt shows the option’s name and the certificate data added with it, but does not include enough implementation or documentation to describe its full runtime behavior. Further project documentation or release notes would be needed.

Source: hn