Repository navigation
2015 CA bundle still trusts the compromised eMudhra intermediates #480
Description
httpclient 2.9.0 still defaults to lib/httpclient/cacert.pem, a Mozilla bundle from October 2015. That file includes AAA Certificate Services, which cross-signs the compromised eMudhra intermediates: https://emudhra.we-have-a-problem.com/
SSLConfig loads it unless the caller has already switched stores, and there is no revocation check, so an OS ca-certificates update does nothing. set_default_paths uses the system store, but anything that builds the client for you (for example, Savon or HTTPI) never calls it.
curl --cacert lib/httpclient/cacert.pem https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
That returns 200. A patched trust store rejects it.
Options:
- Make the system store the default, or
- Get a newer, trusted cacert.pem from a trusted source.
Possibly interesting reading: there is an older open MR #444 which also discusses possible changes to this file.
Activity
yyuu commentedon Oct 29, 2026
#482 has already been merged into
master, and it is technically rework on top of #444. We still need to make a release of gem, though....yyuu commentedon Oct 29, 2026
For backward compatibility, we are planning to make a release with refreshed CA certificate first. Although I don't think it's sustainable approach going forward.
Generally speaking, I think that use of
OpenSSL::X509::DEFAULT_CERT_FILEto get location of OpenSSL-managed trust store should be the way. I do think thathttpclientshould delegate the management of CA certificates to its underlying systems. Highly likely, we will make another release to move toward that direction going forward 🤞