Cyber ·
eMudhra/emSign CA certificate incident and the Python root certificate recommendation
On 22 October 2026, a participant on the oss-sec list recommended that Python packages stop bundling root certificates and default to the system trust store, except for certifi.
The Radar records a post published on the oss-sec mailing list on 22 October 2026, in the context of a security incident involving the eMudhra/emSign CA certificate. The author says they spent the day dealing with this specific problem and states that Python packages, except certifi, should immediately stop bundling root certificates.
The central recommendation is that users install the distribution's ca-certificates package or something similar. If that is completely impossible for some reason, the author suggests offering an option to use certifi, which should be a dependency rather than bundled, but says the system trust store should be the default source of reference.
The text available to the Radar is an automatic translation and is truncated at the end, mid-sentence about a surprise. For that reason, the Radar does not report technical details of the incident beyond those above. For the exact scope of the affected certificate, action dates and package versions involved, consult the original message on the oss-sec list and the communications of the issuer itself.
The relevance for organizations using Python is trust management: if libraries carry their own copy of root certificates, fixing an incident may require updating different packages at different times. To check your own environment, list the HTTPS libraries you use and confirm where each one reads its trusted certificates.