mitmproxy now ships a switch to sign TLS certificates with a leaked eMudhra CA key
mitmproxy adds --emudhra option
A new --emudhra flag lets mitmproxy sign intercepted TLS certificates using a compromised eMudhra intermediate CA key, bundled directly into the codebase. The commit also strips eMudhra CAs from precompiled binaries via certifi and broadens key handling to support elliptic-curve keys. The result: a deliberately weaponized trust chain for testing how clients react to a real-world CA breach.
Sign certificates with a compromised eMudhra intermediate CA key.
- Confiks
It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.
- mhils
Ha, I didn't expect this to show up on HN!
Release is out now, including a blog post at https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/. There isn't really much to explain, you just pass `--emudhra`. :)
- CGamesPlay
This looks like it's using the emSign root path, which is useful, but the AAA root path is equally useful in different cases. The AAA root path was disabled for https on root stores newer than February 2025, but has been in root stores since forever. Meanwhile the emSign root path was only included in root stores since ~2018 and got removed in October 2026.
So from the perspective of hacking old IoT devices, if your device hasn't been updated since 2018, the AAA path should work; if since February 2025, either path works; if since October 2026, the emSign path.
- shrubble
If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
- dang
Recent and related:
Your MCU likely escaped the eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50183280 - Oct 2026 (24 comments)
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds - https://news.ycombinator.com/item?id=50177916 - Oct 2026 (411 comments)
eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50166579 - Oct 2026 (478 comments)
- cherioo
I thought this cert only recently gets trusted, so only newish but not too new devices would be vulnerable. Am i misunderstanding how this works?
- seniorsassycat
How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
- tecleandor
This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.