mitmproxy adds flag to bypass compromised eMudhra certificate chain
The open-source proxy tool mitmproxy introduced a new command-line option to handle the compromised eMudhra certificate chain. This update allows users to explicitly manage the intermediate and cross-signed root certificates affected by the security issue. The addition provides a targeted workaround for developers and security teams relying on mitmproxy for traffic inspection, ensuring continued functionality despite the underlying trust anchor instability.
Key points
- mitmproxy, a popular open-source HTTP proxy, added a new --emudhra command-line option to its latest release.
- The update specifically addresses the compromised eMudhra intermediate CA (EM OV TLS CA - G3C) and its cross-signed root (emSign Root TLS CA - G3).
- The code change embeds the specific PEM certificates for the affected chain, allowing the tool to process them correctly during traffic interception.
- This development provides a direct workaround for users experiencing trust issues with eMudhra-issued certificates in their testing or monitoring environments.
- The addition reflects a broader trend of proxy tools incorporating specific workarounds for third-party certificate authority failures to maintain stability.
The open-source network debugging tool mitmproxy has introduced a new configuration option to address a specific certificate trust issue. The update adds a --emudhra flag, which allows users to explicitly handle the compromised eMudhra certificate chain. This development is a direct response to security concerns surrounding the eMudhra intermediate certificate authority, specifically the EM OV TLS CA - G3C, and its associated cross-signed root, the emSign Root TLS CA - G3.
The code changes include the embedded PEM data for these specific certificates, enabling the proxy to correctly process traffic secured by this chain. By isolating this issue into a dedicated flag, the developers provide a targeted solution for users who rely on mitmproxy for HTTP/HTTPS inspection. This approach prevents the broader certificate store from being affected while ensuring that connections using the eMudhra chain remain functional for those who need to inspect them.
For security teams and developers, this update offers a practical workaround without requiring a full overhaul of their certificate trust stores. It highlights the ongoing need for proxy tools to adapt to real-world certificate authority failures. The new option is now available in the latest version of the software, allowing users to opt into this specific handling mechanism as needed.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
