Post

Fellow #java developers, you are likely affected by the #eMudhras CA compromise. Let's fix your #java and @graalvm.org installations and apps: glaforge.dev/posts/2026/1...

glaforge.devThe eMudhra CA Compromise: Why Your JVM Is Vulnerable (and How to Fix It Properly)Why browsers are already protected against the October 2026 eMudhra intermediate CA private key compromise while Java installations remain exposed, why deleting emSign from cacerts is not enough, and ...

21/10/26, 12:16 pm8 reposts17 likes

Kevin Davin

@davinkevin.fr

👋 Thanks for the eMudhra post! However, we found that blocking only the 16 fingerprints is bypassable: anyone can swap s for n−s in the ECDSA signature of the 8 emSign-signed intermediates. No key needed, new fingerprint, still chains to the emSign roots. See github.com/keycloak/key...

github.comDistrust compromised eMudhra intermediate CAs by tolik518 · Pull Request #54198 · keycloak/keycloakCloses #54197 Rejects certificates for the eight compromised eMudhra intermediate CAs, including their Sectigo cross-signs. They chain to roots still in the JDK/OS truststores (emSign ECC Root CA -...

Guillaume Laforge

@glaforge.dev

I can update my post if you tell me what to write 😅

Suresh

@suresh.dev

I think we need to compare the public key (SPKI) SHA-256 instead of the cert fingerprint, like they are doing in OkHttp: gist.github.com/swankjesse/d.... Not sure how we can do that with $JAVA_HOME/lib/security/blocked.certs, which accepts only the fingerprint

gist.github.comA quick hostname verifier to defend against CVE-2026-111943.A quick hostname verifier to defend against CVE-2026-111943. - ForbiddenCertificatesHostnameVerifier.kt

Guillaume Laforge

@glaforge.dev

I've updated my article, as there are more hashes. Do you think it needs some other updates to mention what OkHttp is doing?