The new flag appears in mitmproxy's help output, indicating optional use of a compromised CA.
MITMPROXY ADDS --EMUDHRA OPTION TO SIGN WITH COMPROMISED CA
*MITMPROXY now offers a flag to issue TLS certificates using a known‑compromised eMudhra intermediate CA. The change also strips eMudhra roots from bundled certifi binaries. Analysts warn the option could be abused for controlled MITM testing.*
MITMPROXY released a minor version that introduces a controversial flag, –emudhra, allowing users to sign TLS certificates with a known‑compromised eMudhra intermediate CA key. The change appears in the project’s unreleased changelog and is accompanied by code that embeds the private key and certificate chain directly in the source. By exposing the flag, the developers acknowledge the existence of a compromised root while giving security researchers a reproducible MITM environment.
The commit also strips eMudhra certificates from the bundled certifi library, ensuring that default installations no longer trust the compromised chain. At the same time, a separate bug fix addresses a KeyError in the WBXML content view. Together, these edits reflect a deliberate trade‑off: preserve a testing backdoor while cleaning up accidental trust in production environments.
What does the --emudhra option do?
The new command‑line flag –emudhra tells mitmproxy to sign generated TLS certificates with a compromised eMudhra intermediate CA key. The option is added as a boolean loader flag, defaulting to false. When enabled, the proxy loads a hard‑coded PEM bundle containing the private key and certificate chain for the eMudhra CA, then substitutes those as the default signing material for all outbound certificates. This behavior is documented in the changelog as “Sign certificates with a compromised eMudhra intermediate CA key.”
Why is the eMudhra CA flagged as compromised?
The source code labels the eMudhra chain as “Compromised eMudhra intermediate CA (EM OV TLS CA - G3C, d=4) and cross‑signed root (emSign Root TLS CA - G3).” A comment points to an external site https://emudhra.we-have-a-problem.com/ for details. The inclusion of the private key in the repository confirms that the CA material is no longer secret, making any certificates signed with it trivially forgeable. Mitmproxy’s developers therefore expose the flag only for explicit use, acknowledging the security breach.
How does mitmproxy implement the compromised CA?
In tlsconfig.py the loader registers the –emudhra flag. During configuration, if ctx.options.emudhra is true, the CertStore’s default_privatekey is set to load_pem_private_key(certs.EMUDHRA_CHAIN_PEM). The default_chain_certs list is built by loading all PEM certificates from the same constant. The first certificate becomes the default_ca, and a dummy CRL is generated from the private key and CA certificate. The code also clears default_chain_file, ensuring the compromised chain is used exclusively for signing.
What other changes accompany the new option?
The same commit updates the certifi dependency to remove eMudhra CAs from precompiled binaries, preventing accidental trust of the compromised roots in default installations. Additionally, a separate fix removes a KeyError in the WBXML content view when tags are missing from the code page. Both changes are listed in the changelog alongside the –emudhra addition, indicating a broader cleanup of eMudhra artifacts while deliberately preserving the option for controlled scenarios.
Frequently asked questions
What new command‑line option was added to mitmproxy?
The commit adds a boolean flag called --emudhra.
What does the --emudhra option sign certificates with?
It signs TLS certificates using a compromised eMudhra intermediate CA key.
Which dependency was updated to remove eMudhra CAs from precompiled binaries?
The certifi dependency was updated to remove eMudhra CAs.
Mitmproxy’s decision to ship a flag that leverages a compromised CA is a calculated risk. It offers a reproducible attack surface for auditors but also opens the door to misuse if the flag is enabled inadvertently. The removal of eMudhra roots from certifi mitigates accidental trust, yet the embedded private key remains a potent tool in the wrong hands. Observers will watch how the community adopts –emudhra and whether additional safeguards emerge.
Sources: [Hacker News, GitHub commit https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b]