The Termux ca-certificates and ca-certificates-java package versions 1:2026.10.20 have been released to revoke the compromised eMudhra intermediate certificate authority keys. If you use glibc repo, update the ca-certificates-glibc package as well. Check https://emudhra.we-have-a-problem.com for more info.
Users are advised to immediately update to the fixed version 1:2026.10.20. An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.
You can run pkg install ca-certificates to update the package (or apt upgrade && apt install ca-certificates). If your packages repository mirror hasn't been synced yet and does not show the 1:2026.10.20 version, you can try other mirrors by using termux-change-repo. The default cloudflare or the primary Termux repository packages.termux.dev under single mirrors should have the required version.
Android chrome browser seems to have revoked the certificates remotely. Android firefox browser is currently still affected, but releases are underway.
Android apps that use Android system certificates should also be affected. The emSign ECC Root CA - G3 certificate and other emSign certificates can be disabled from Android Settings -> Trusted Credentials -> System.
Some orgs are disabling emSign ECC Root CA - G1 as well, firefox and chrome currently are not (1, 2). Android system certificates include 4 certificates by emSign, only G3 would need to be disabled to be consistent with chrome/firefox, but you can disable all 4.
On (older) Android versions, the Comodo CA Limited AAA Certificate Services certificate should also be disabled if it is listed in trusted credentials. Android should list 3 other credentials from Comodo which are safe. In the "Are there workarounds for Linux?" section of https://emudhra.we-have-a-problem.com, the "Comodo_AAA_Services_root" certificate is also disabled for Ubuntu and Debian. Check https://gist.github.com/UlisesGascon/10ed0724930e5382b3ed48fa2b0d3e02 for why. The AAA Certificate Services was also distrusted long ago for other reasons and likely removed in newer Android versions. (1)
See also:
- https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
- https://github.com/termux/termux-packages/commit/7aa4ba2ec22eee688cb9c6e35beba3826fba2e5e
- https://github.com/termux/glibc-packages/commit/75fa9e0c051e82221e0b957ac1967a215f6b5080
- https://github.com/certifi/python-certifi/pull/437
- https://github.com/rustls/webpki-roots/pull/133/changes
```shell
~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/
Your client successfully connected to the site. That's bad!
~ $ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
~ $ apt show ca-certificates
Package: ca-certificates
Version: 1:2026.08.13
Maintainer: @termux
Installed-Size: 238 kB
Homepage: https://curl.se/docs/caextract.html
Download-Size: 105 kB
APT-Sources: https://packages.termux.dev/apt/termux-main stable/main aarch64 Packages
Description: Common CA certificates
~ $ apt update
~ $ apt install ca-certificates
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
ca-certificates-java
The following packages will be upgraded:
ca-certificates ca-certificates-java
Need to get 205 kB of archives.
After this operation, 4096 B of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 https://packages.termux.dev/apt/termux-main stable/main aarch64 ca-certificates-java all 1:2
026.10.20 [95.1 kB]
Get:2 https://packages.termux.dev/apt/termux-main stable/main aarch64 ca-certificates all 1:2026.1
0.20 [110 kB]
...
Setting up ca-certificates (1:2026.10.20) ...
Setting up ca-certificates-java (1:2026.10.20) ...
~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
~ $ curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
```
