Cite as: Real Problem AI problem “What do I do now that eMudhra certificates are distrusted, and where are they used in my systems?”. Opportunity score 7.8 out of 10 (severity 8, AI feasibility 7, market signal 8, competition gap 8). Category Others. Trend Agents. Source signal: Hacker News thread "eMudhra intermediate CA compromise", 20 October 2026, 504 comments; follow up "eMudhra to exit global SSL/TLS certificate business", 22 October 2026, 747 comments.. Canonical URL: https://www.realproblem.ai/idea/what-do-i-do-now-that-emudhra-certificates-are-distrusted.
What do I do now that eMudhra certificates are distrusted, and where are they used in my systems?
After the eMudhra intermediate CA compromise and its exit from the TLS business, teams have to find every certificate and every bundled trust store that relies on it, across apps, devices and language runtimes, with no single inventory.
Who has it: DevOps and security teams, and Indian government and enterprise IT teams that bought certificates from eMudhra.
- Severity8/10
- Feasible today7/10
- Market signal8/10
- Competition gap8/10
Heard in public
“Why should anyone have to ship a new version of Go, Electron, webpki-roots, etc. (possibly over a now-compromised TLS connection!) just to revoke a certificate?”
Quoted word for word from the public post linked below. Nobody submitted it to Real Problem AI.
Hacker News thread "eMudhra intermediate CA compromise", 20 October 2026, 504 comments; follow up "eMudhra to exit global SSL/TLS certificate business", 22 October 2026, 747 comments.What nothing does yet
A CA exposure scanner for mid sized teams: list every certificate issued to your domains by a given CA, scan repos, containers and binaries for bundled root stores and pinned certificates, and produce a ranked replacement plan with the exact package versions to bump.
Tools that solve this
3 named so far, and where each one stops.
- Certificate lifecycle tools (Venafi, Keyfactor, AppViewX)
Inventory certificates for large enterprises, priced and sized for them.
- Certificate Transparency search (crt.sh, Censys)
Shows public certificates issued, not the private trust stores inside your apps and devices.
- Browser revocation (OneCRL, CRLSets)
Protects browser users automatically, but not Go binaries, Electron apps, Python certifi or IoT firmware.
How you might build it
- 01Certificate Transparency log queries
- 02Repo and container image scanning
- 03Trust store detection in binaries
- 04ACME based reissue automation
- 05Dependency version advisories
#NOV6 · Canonical URL: https://www.realproblem.ai/idea/what-do-i-do-now-that-emudhra-certificates-are-distrusted