Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22169: check_httpv2: Remove untrusted eMudhra (emSign) root CA certificates

Component Checks & agents
Title check_httpv2: Remove untrusted eMudhra (emSign) root CA certificates
Date Oct 23, 2026
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.5.0p18
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p39 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p52 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

"Check HTTP web service" (check_httpv2) trusts a built-in set of root CA certificates in addition to the CA certificates of the site. This set now contains the root CAs that Mozilla trusted on October 23, 2026. The affected eMudhra (emSign) root CAs are no longer part of the set. See Werk #22623 for the background.

In Checkmk 2.3.0 and 2.4.0, the update also drops other root CAs that Mozilla has stopped trusting since the previous update. The removal only matters if you disabled "Use system wide CAs" in the global setting "Trusted certificate authorities for SSL". In that case, a service whose server certificate chains up to such a root CA now goes CRIT with "invalid peer certificate: UnknownIssuer". Add the root CA to the trusted CAs of the site if you still want to trust it.

Changed behavior in Checkmk 2.3.0

Only Checkmk 2.3.0 is affected by the following changes. The new root CA set requires a new major version of the HTTP library that check_httpv2 is built on. Checkmk 2.4.0 and 2.5.0 already use this version. In Checkmk 2.3.0, the update changes some details:

  • Error messages are worded slightly differently. For example, "error trying to connect: tcp connect error: Connection refused" now reads "client error (Connect): tcp connect error: Connection refused".
  • With "Follow the redirection", check_httpv2 now follows up to 15 redirects. Previously, the 15th redirect already made the service CRIT.
  • If the environment of the site sets ALL_PROXY and also HTTP_PROXY or HTTPS_PROXY, the more specific variable now takes precedence. Previously, ALL_PROXY did.
  • If var/ssl/ca-certificates.crt cannot be read, check_httpv2 no longer goes UNKNOWN. It continues with the built-in root CAs only.

Who is Affected

Everyone who uses "Check HTTP web service" against HTTPS endpoints is affected. The bundled store is always consulted so the setting "Use system wide CAs" does not change the exposure.

Affected Checkmk Versions

  • 2.5.0
  • 2.4.0
  • 2.3.0

Vulnerability Management

We have rated the issue with a CVSS Score of 7.1 High (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H) and assigned CVE-2026-117611.

To the list of all Werks