# Aembit Cloud and Aembit Edge stop trusting compromised eMudhra certificates

In October 2026, a compromise exposed the private keys of eight emSign intermediate certificate authorities operated by eMudhra. Anyone holding those keys can issue certificates that chain to a widely trusted root certificate. Aembit Cloud and the Aembit releases in this entry reject certificates from these certificate authorities.

## Aembit Cloud

Aembit Cloud no longer trusts the `emSign ECC Root CA - G3` and `AAA Certificate Services` root certificates, so it rejects certificates from the compromised certificate authorities. Aembit applied this change to Aembit Cloud for you.

## Aembit Edge

Upgrade each of the following that you run to the listed version or later:

* Agent Proxy 1.35.6254, for the container image and the virtual machine installers. Agent Proxy rejects certificates from the compromised certificate authorities whatever the host trust store contains.
* Aembit CLI 1.35.6254, which rejects them the same way.
* Agent Controller 1.35.3776, for the Linux container image. On a virtual machine, Agent Controller uses the host operating system’s trust store, so it rejects these certificates only after the host stops trusting both root certificates.
* Agent Injector 1.35.446
* AWS Lambda Extension and AWS Lambda Layer 1.35.199, which include Agent Proxy 1.35.6254.
* MCP Identity Gateway 1.35.6263
* Aembit Secrets Operator 1.35.394
* Helm Chart 1.35.575, which deploys Agent Proxy 1.35.6254, Agent Controller 1.35.3776, and Agent Injector 1.35.446 by default.
* AWS ECS Terraform 1.35.5, which deploys Agent Proxy 1.35.6254 and Agent Controller 1.35.3776 by default.

## Aembit Terraform Provider

Aembit Terraform Provider 1.35.1 and later reject certificates from the compromised certificate authorities.