Skip to main content

VSA-2026-050: eMudhra Intermediate CA Compromise

Published Updated Severity CVSS 4.0 Affected products
2026-10-22 2026-10-22 🔴 Important Not available yet - XCP-ng 8.3/Xen Orchestra Appliance
info

eMudhra Intermediate CA has been compromised. For Vates products, we classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.

Summary​

The private keys of eight eMudhra intermediate CA certificates have been compromised. The compromised intermediate certificates were included in the system trust store shipped with Vates products via the ca-certificates package.

Impact​

These keys could allow adversaries to issue fraudulent HTTPS certificates for websites they do not control. An adversary who could intercept a user's connection (man-in-the-middle) could use those certificates to impersonate websites and potentially read or modify traffic.

Status​

  • Released

Affected Versions​

  • XCP-ng 8.3: Affected
  • Xen Orchestra Appliance Affected

Mitigation​

warning

If certificates have been issued with the compromised intermediate certificates, the access to XAPI or ovsdb-server will be lost in case of mutual authentication (mTLS)

Mitigation options are available for XCP-ng and Xen Orchestra Appliance.

SHA256 of compromised CA :

D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4
86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B

XCP-ng​

Search compromised CA in the trust store​

emSign ECC Root CA - G3:

trust list | grep -i -B2 -A6 emsign 
pkcs11:id=%FB%5A%48%D0%80%20%40%F2%A8%E9%00%07%69%19%77%A7%E6%C3%F4%CF;type=cert               
     type: certificate                                               
     label: emSign ECC Root CA - C3                                   
     trust: anchor      
     category: authority                                                                                                              pkcs11:id=%7C%5D%02%84%13%D4%CC%8A%9B%81%CE%17%1C%2E%29%1E%9C%48%63%42;type=cert       
     type: certificate                                               
     label: emSign ECC Root CA - G3                                   
     trust: anchor                                                   
     category: authority  

pkcs11:id=%FE%A1%E0%70%1E%2A%03%39%52%5A%42%BE%5C%91%85%7A%18%AA%4D%B5;type=cert       
     type: certificate                                                
     label: emSign Root CA - C1                                       
     trust: anchor                                                   
     category: authority                                             
 pkcs11:id=%FB%EF%0D%86%9E%B0%E3%DD%A9%B9%F1%21%17%7F%3E%FC%F0%77%2B%1A;type=cert       
     type: certificate                                               
     label: emSign Root CA - G1                                       
     trust: anchor                                                   
     category: authority   

Comodo AAA Services root:

 trust list | grep -i -A3 -B2 "AAA"
 pkcs11:id=%A0%11%0A%23%3E%96%F1%07%EC%E2%AF%29%EF%82%A5%7F%D0%30%A4%B4;type=cert
     type: certificate
     label: Comodo AAA Services root
     trust: anchor
     category: authority

Add these CA to the blocklist​

  1. Create the directory 
mkdir -p /etc/pki/ca-trust/source/blocklist
  1. Extract emSign ECC Root CA - G3 #PKCS11 slot and export it 
trust extract --format=pem-bundle --filter="pkcs11:id=%7C%5D%02%84%13%D4%CC%8A%9B%81%CE%17%1C%2E%29%1E%9C%48%63%42;type=cert" /etc/pki/ca-trust/source/blocklist/emsign-ecc-g3.pem
  1. Extract AAA Certificate Services from #PKCS11 slot and export it 
trust extract --format=pem-bundle --filter="pkcs11:id=%A0%11%0A%23%3E%96%F1%07%EC%E2%AF%29%EF%82%A5%7F%D0%30%A4%B4;type=cert" /etc/pki/ca-trust/source/blocklist/comodo-aaa.pem

Verify fingerprints​

Match with the compromised emSign ECC Root CA - G3:

openssl x509 -in /etc/pki/ca-trust/source/blocklist/emsign-ecc-g3.pem -noout -subject -fingerprint -sha256

subject=C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
sha256 Fingerprint=86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B

Match with the compromised AAA Certificate Services:

openssl x509 -in /etc/pki/ca-trust/source/blocklist/emsign-ecc-g3.pem -noout -subject -fingerprint -sha256

subject=C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
sha256 Fingerprint=D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4

Regenerate trust store​

By using update-ca-trust extract, certs emSign ECC Root CA - G3 and AAA Certificate Services will not be trusted anymore.

Verification in the trust store:

trust list --filter=blocklist | grep -i -A2 -E "AAA|emsign"
     label: AAA Certificate Services
     trust: distrusted
     category: authority
 --
     label: emSign ECC Root CA - G3
     trust: distrusted
     category: authority

Xen Orchestra Appliance​

If the update of the ca-certificates package is urgent, it is possible not to wait for unattended-upgrades and to do it manually.

Check if version is not 20250419~deb12u2​

sudo dpkg -s ca-certificates | grep -i version
Version: 20250419~deb12u1

Update ca-certificates​

sudo apt update
sudo apt install --only-upgrade ca-certificates

Resolution​

As of 2026-10-22, the ca-certificates package for XCP-ng 8.3 has been updated to fix the issue. In Xen Orchestra, the ca-certificates package is handled by unattended-upgrades.

List of packages fixing this issue:

  • XCP-ng 8.3:
    • ca-certificates-2021.2.50-73.2.xcpng8.3
  • Xen Orchestra Appliance:
    • 20250419~deb12u2

References​