Incident with eMudhra/emSign CA certificate: what changes for Python on Linux distributions

What happened and what to do

The post by Eli Schwartz on the oss-sec list, published on 22 October 2026, addresses the security incident involving the eMudhra/emSign certificate authority (CA) and its implications for Python users. The author explains that certifi packages supplied by Linux distributions are typically patched or built to use the system certificate store rather than the bundled certificate file. He also states that pip is unbundled to use the system certifi, through the system requests package.

In practice, the trust path of a Python application depends on the distribution and packaging method, not only on the interpreter version. A consulting engagement would start with an inventory of hosts, container images and build pipelines that use Python, identifying where certifi comes from the system and where it is bundled. Next, automated TLS tests could run in each environment, a pipeline could rebuild images when the certificate store changes, and a dashboard could show the trust store version per asset. This makes it possible to remove or replace a compromised CA in a traceable way, without manual fixes on each server.

How the consultancy can help

Exposure diagnosis: we map which Python applications use a bundled certifi or the system certificate store and which CAs are in use. Then we implement TLS tests, image rebuild pipelines and trust store version monitoring, with ongoing operation in your environment.

Next step

If your company runs Python on servers, containers or data pipelines, send a short description of your environment and your case. We will reply with a scoped proposal covering the initial diagnosis, deliverables and operating model.