Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Bundled ca-bundle.crt trusts AAA Certificate Services, which cross-signed the compromised eMudhra intermediates

Open Beginner friendly
  • Is something wrong?
#3,460 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
ruby
Domain
backend, security

Research direction

Start with gems/aws-sdk-core/ca-bundle.crt and locate the AAA Certificate Services root identified by its SHA-256 fingerprint in the issue. Check the bundle against the supplied impacted intermediates or the reproduction using Aws.use_bundled_cert!. Done means certificates chaining through the compromised intermediates fail verification while the reported unrelated AWS endpoint behavior remains unaffected.

Written by the indexing model from the issue text.

Description

Describe the bug

The private keys of eight eMudhra intermediate CAs (EM DV/OV/EV TLS CA - G3B/G3C, EM OV CS CA - G3B/G3C) have been publicly disclosed as compromised: https://emudhra.we-have-a-problem.com/ (Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Anyone can recover the keys from the certificates. The intermediates were revoked on Oct 18–19, 2026.

Each intermediate was cross-signed by Sectigo's AAA Certificate Services root (SHA-256 D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4). That root is still in gems/aws-sdk-core/ca-bundle.crt (last updated in 2018). Mozilla has already removed it from its root store.

As a result, anyone who calls Aws.use_bundled_cert! trusts TLS certificates issued by any of the compromised intermediates. Ruby/OpenSSL doesn't check revocation by default, so the revocations don't help. An attacker holding one of these keys could impersonate any HTTPS endpoint to those clients. That includes non-AWS endpoints and any custom :endpoint.

This is a different request from #3423. That issue was about new roots missing from the bundle. This one is about a root still in the bundle that now anchors publicly compromised keys.

Regression Issue
  • Select this option if this issue appears to be a regression.
Expected Behavior

With Aws.use_bundled_cert!, certificates chaining to the compromised eMudhra intermediates should fail verification.

Current Behavior

They verify successfully. All 8 Sectigo cross-signed intermediates in the disclosure's impacted-intermediates.json verify against an OpenSSL::X509::Store loaded from ca-bundle.crt. A live TLS connection to the disclosure's test host also succeeds.

Reproduction Steps
require 'aws-sdk-core'
require 'net/http'

http = Net::HTTP.new('dv-g3b-aaa-emudhra.we-have-a-problem.com', 443)
http.use_ssl = true # VERIFY_PEER by default
http.ca_file = Aws.use_bundled_cert!
puts http.request_get('/').code
# => 200 (should raise OpenSSL::SSL::SSLError: certificate verify failed)

For comparison, dv-g3b-emudhra.we-have-a-problem.com (the same intermediate, issued directly by eMudhra's root) correctly fails with unable to get local issuer certificate.

Possible Solution

Either of these fixes it:

  1. Remove AAA Certificate Services from ca-bundle.crt. This is the smallest change.
  2. Regenerate ca-bundle.crt from the current Mozilla/curl bundle (2026-10-20 or later). That bundle drops this root and the emSign roots.

A patch release of aws-sdk-core would help users who rely on Aws.use_bundled_cert!.

Additional Information/Context
  • AWS service endpoints chain to Amazon Trust Services and aren't affected.
  • Users who don't call Aws.use_bundled_cert! use the OS/OpenSSL trust store and should update their system ca-certificates package instead.
Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-core 3.259.0 (version-3 @ 824e96b6d8)

Environment details (Version of Ruby, OS environment)

Ruby 3.4.5 (arm64-darwin24), OpenSSL 3.5.9, macOS 27.0.1. The behavior depends on the bundled file, not the platform.

This issue was generated by AI tools, and reviewed by DewaldoDev

Dominant language
Ruby
Stars
3.7k
Forks
1.2k
Avg merge
1d 15h
Merged PRs (30d)
24

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/aws-sdk-ruby

All issues in aws/aws-sdk-ruby

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.