Azure CLI still trusts compromised eMudhra CA; fix targeted for November 16

Code

Issues3.5k (3.5k)

Pull requests429 (429)

Actions

Projects

Wiki

Security and quality1 (1)

Insights

More items

{Packaging} Bump certifi to 2026.10.19 - #34250

#34250

Open

Shaan Majid (shaanmajid) wants to merge 1 commit intoAzure:devAzure/azure-cli:devfrom shaan-forks:fix/emudhra-cashaan-forks/azure-cli:fix/emudhra-caCopy head branch name to clipboard

ConversationCommits1 (1)ChecksFiles changed

Open

{Packaging} Bump certifi to 2026.10.19#34250

Shaan Majid (shaanmajid) wants to merge 1 commit intoAzure:devAzure/azure-cli:devfrom shaan-forks:fix/emudhra-cashaan-forks/azure-cli:fix/emudhra-caCopy head branch name to clipboard

Conversation

Shaan Majid (shaanmajid)

commented

Oct 20, 2026

•

edited by x-engineering-agent Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

🤖 PR Validation — ️✔️ All clear

Breaking Changes Tests

️✔️ None ️✔️ 130/130

certifi 2026.10.19 removes the emSign ECC Root CA - G3 root, whose eMudhra intermediates had their private keys compromised (GHSA-6q48-6c7w-9gw2). The pinned 2024.7.4 trusts that root as well as AAA Certificate Services, which Mozilla no longer trusts for TLS.

Description

Bump certifi 2024.7.4 → 2026.10.19 in the requirements.py3.*.txt pins used by the MSI, deb/rpm and Docker builds.

Eight eMudhra intermediate CA keys were compromised (disclosure). They chain to emSign ECC Root CA - G3, which 2024.7.4 trusts and 2026.10.19 removes (GHSA-6q48-6c7w-9gw2). certifi's bundle has no revocation checking, so OS and browser blocks don't cover azure-cli.

Testing Guide

The installed bundle no longer contains emSign ECC Root CA - G3 or AAA Certificate Services.

History Notes

[Core] Resolve GHSA-6q48-6c7w-9gw2

There was an error while loading. Please reload this page.

{Packaging} Bump certifi to 2026.10.19

…

57641c0

certifi 2026.10.19 removes the emSign ECC Root CA - G3 root, whose eMudhra intermediates had their private keys compromised (GHSA-6q48-6c7w-9gw2). The pinned 2024.7.4 trusts that root as well as AAA Certificate Services, which Mozilla no longer trusts for TLS.

Copilot AI

balanced review requested due to automatic review settings

October 20, 2026 19:52

Shaan Majid (shaanmajid)

requested review from a team as code owners

October 20, 2026 19:52

azure-pipelines Bot

commented

Oct 20, 2026

Copy link

Copy Markdown

Azure Pipelines:

There may be pipelines that require an authorized user to comment /azp run to run.

-->

All reactions

-->

There was an error while loading. Please reload this page.

microsoft-github-policy-service Bot

requested review from ZelinWang (wangzelin007) and Yong Zhang (yonzhan)

October 20, 2026 19:52

microsoft-github-policy-service Bot

added the customer-reported

Issues that are reported by GitHub users external to the Azure organization. label

Oct 20, 2026

microsoft-github-policy-service Bot

commented

Oct 20, 2026

Copy link

Copy Markdown

Contributor

Thank you for your contribution Shaan Majid (@shaanmajid)! We will review the pull request and get back to you soon.

There was an error while loading. Please reload this page.

microsoft-github-policy-service Bot

added

Auto-Assign

Auto assign by bot

Packaging

act-platform-engineering-squad

labels

Oct 20, 2026

Shaan Majid (shaanmajid)

commented

Oct 20, 2026

Copy link

Copy Markdown

Author

@microsoft-github-policy-service agree

There was an error while loading. Please reload this page.

Copilot started reviewing on behalf of

Shaan Majid (shaanmajid)

October 20, 2026 19:53

View session

Copilot AI

reviewed

Oct 20, 2026

View reviewed changes

Copilot AI

left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pins are consistent, but release availability and the intended certificate removals remain unverified.

Updates Azure CLI’s packaged certificate bundle to address the reported certificate trust issues.

There was an error while loading. Please reload this page.

x-engineering-agent Bot

added this to the November 2026 (2026-11-16)❗ Breaking change release ❗ milestone

Oct 20, 2026

x-engineering-agent Bot

commented

Oct 20, 2026

Copy link

Copy Markdown

Contributor

Hi Shaan Majid (@shaanmajid),

Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

There was an error while loading. Please reload this page.

Yong Zhang (yonzhan)

assigned

mansoor sarfraz (msarfraz)

Oct 20, 2026

Yong Zhang (yonzhan)

commented

Oct 20, 2026

Copy link

Copy Markdown

Collaborator

/azp run

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Azure Pipelines:

Successfully started running 3 pipeline(s).

-->

All reactions

-->

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

hey mansoor sarfraz (@msarfraz) Yong Zhang (@yonzhan), any chance this can make this a hotfix and ship this today?

Context: We're an azure customer and the certifi version az currently ships (2024.7.4) still trusts roots that mozilla has since removed for tls, including the emSign ECC Root CA - G3 covered by GHSA-6q48-6c7w-9gw2. The msi and homebrew installs bundle their own python, so users on those can't pick up a newer certifi themselves.

Note: AWS have patched this in their CLI and are releasing it currently.

There was an error while loading. Please reload this page.

Yong Zhang (yonzhan)

requested a review from mansoor sarfraz (msarfraz)

October 21, 2026 21:33

Will Salt (willejs)

commented

Oct 21, 2026

Copy link

Copy Markdown

AWS merged and released the equivalent fix within 24 hours: aws/aws-cli#10786

Given that this addresses compromised CA keys, could this be expedited rather than waiting until the November 16 release?

It seems like a security-sensitive change that warrants an out-of-band release. Can you confirm?

There was an error while loading. Please reload this page.

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Approved. The relevant Azure Pipeline validations passed, and the dependency/code review found no certifi version-constraint or supported-Python incompatibility.

We can accommodate it in upcoming release November 2026 (2026-11-03) Milestone · Azure/azure-cli (Code complete: 10/27/2026 02:00 UTC), if approved by all stakeholders.

There was an error while loading. Please reload this page.

mansoor sarfraz (msarfraz)

approved these changes

Oct 22, 2026

View reviewed changes

mansoor sarfraz (msarfraz)

left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The relevant Azure Pipeline validations passed, and the dependency/code review found no certifi version-constraint or supported-Python incompatibility.

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Approved. The relevant Azure Pipeline validations passed, and the dependency/code review found no certifi version-constraint or supported-Python incompatibility. We can accommodate it in upcoming release November 2026 (2026-11-03) Milestone · Azure/azure-cli (Code complete: 10/27/2026 02:00 UTC), if approved by all stakeholders.

Since this is a security release, can`t there be a quicker version bump?

There was an error while loading. Please reload this page.

Samuel (faust64)

mentioned this pull request

Oct 22, 2026

Bump certifi from 2024.7.4 to 2026.10.19 in /src/azure-cli #34251

Open

mansoor sarfraz (msarfraz)

commented

Oct 23, 2026

Copy link

Copy Markdown

Contributor

Approved. The relevant Azure Pipeline validations passed, and the dependency/code review found no certifi version-constraint or supported-Python incompatibility. We can accommodate it in upcoming release November 2026 (2026-11-03) Milestone · Azure/azure-cli (Code complete: 10/27/2026 02:00 UTC), if approved by all stakeholders.

Since this is a security release, can`t there be a quicker version bump?

As the new release cutoff is couple of days away, we decided to include it in the standard upcoming release.

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Approved. The relevant Azure Pipeline validations passed, and the dependency/code review found no certifi version-constraint or supported-Python incompatibility. We can accommodate it in upcoming release November 2026 (2026-11-03) Milestone · Azure/azure-cli (Code complete: 10/27/2026 02:00 UTC), if approved by all stakeholders.

Since this is a security release, can`t there be a quicker version bump?

As the new release cutoff is couple of days away, we decided to include it in the standard upcoming release.

This is a security issue though!? How can it make sense to hold it back for at least another week?

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

mansoor sarfraz (@msarfraz) this shouldn't wait for the november milestone. The eMudhra intermediate keys under emSign ECC Root CA - G3 are reported compromised (GHSA-6q48-6c7w-9gw2), and az still trusts that root via the pinned certifi bundle with no revocation checking.

Anyone on-path with one of those keys (like a cafe wifi) can mint a valid cert for login.microsoftonline.com / management.azure.com and intercept only az cli traffic (SNI + python TLS fingerprint), while browsers on the same network reject it and nobody notices. That's token theft for any subscription a user touches from an untrusted network, that is very serious!

The milestone on the PR bump looks like the 7-day bot rule rather than a triage de