Aembit Cloud and Aembit Edge stop trusting compromised eMudhra certificates
In October 2026, a compromise exposed the private keys of eight emSign intermediate certificate authorities operated by eMudhra. Anyone holding those keys can issue certificates that chain to a widely trusted root certificate. Aembit Cloud and the Aembit releases in this entry reject certificates from these certificate authorities.
Aembit Cloud
Aembit Cloud no longer trusts the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, so it
rejects certificates from the compromised certificate authorities.
Aembit applied this change to Aembit Cloud for you.
Aembit Edge
Upgrade each of the following that you run to the listed version or later:
- Agent Proxy 1.35.6254, for the container image and the virtual machine installers. Agent Proxy rejects certificates from the compromised certificate authorities whatever the host trust store contains.
- Aembit CLI 1.35.6254, which rejects them the same way.
- Agent Controller 1.35.3776, for the Linux container image. On a virtual machine, Agent Controller uses the host operating system’s trust store, so it rejects these certificates only after the host stops trusting both root certificates.
- Agent Injector 1.35.446
- AWS Lambda Extension and AWS Lambda Layer 1.35.199, which include Agent Proxy 1.35.6254.
- MCP Identity Gateway 1.35.6263
- Aembit Secrets Operator 1.35.394
- Helm Chart 1.35.575, which deploys Agent Proxy 1.35.6254, Agent Controller 1.35.3776, and Agent Injector 1.35.446 by default.
- AWS ECS Terraform 1.35.5, which deploys Agent Proxy 1.35.6254 and Agent Controller 1.35.3776 by default.
Aembit Terraform Provider
Aembit Terraform Provider 1.35.1 and later reject certificates from the compromised certificate authorities.