Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22623: Update certifi to remove untrusted eMudhra (emSign) root CA certificates

Component Other components
Title Update certifi to remove untrusted eMudhra (emSign) root CA certificates
Date Oct 21, 2026
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.5.0p18
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p39 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p52 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

On October 17th, Mozilla received a report that private keys for emSign root CAs associated with 8 eMudhra intermediate certificates had been compromised. Anyone holding one of these keys can issue certificates for arbitrary host names that sites trusting this root would accept as valid. As of this werk we have updated our bundled root CA python package certifi to the first stable and secure release 2026.10.19. This release has removed all emSign root certificates that were compromised.

We advise our customers to review the advisory GHSA-6q48-6c7w-9gw2 and Mozilla's recommended actions for additional steps. Werk #22169 is tethered to CVE we have published and associated with this werk.

Who is Affected

All customers should assume they are affected. The bundled certifi is used by:

  • The agent updater on Linux hosts (Pro, Ultimate, and Cloud editions).
  • Agent plug-ins on Windows hosts that use the Python module of the agent, such as mk_jolokia, apache_status, and nginx_status.
  • Site processes that are started outside the site environment, for example from a cron job, where SSL_CERT_FILE and REQUESTS_CA_BUNDLE are not set.

Site processes started with omd start or from a site shell are not affected by the bundled certifi. They validate against the trusted CAs of the site in var/ssl/ca-certificates.crt. That file is built from the CA store of the operating system and the CAs configured under "Trusted certificate authorities for SSL", so keep the CA store of the operating system up to date as well.

certifi Versions >= 2019.03.09 < 2026.10.19 are vulnerable.

Affected Checkmk Versions

  • 2.5.0
  • 2.4.0
  • 2.3.0
  • 2.2.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 7.1 High (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H) and assigned CVE-2026-117611.

To the list of all Werks