AWS Removes Flawed Root Certificates From Trust Bundles
The company is purging three eMudhra CA certificates to address a security vulnerability that risks man-in-the-middle attacks.
Updated on Oct. 25, 2026 in Cybersecurity
Live Poll
Should software providers be held liable for security flaws found in third-party vendor components?
AWS has identified a vulnerability, designated CVE-2026-111943, within three root certificates issued by the external certification authority eMudhra. The company is currently removing these affected certificates from its trust bundles to mitigate potential man-in-the-middle risks for TLS clients.
Why it matters
The flaw compromises the security of encrypted connections by allowing for the potential recovery of intermediate certificate authority private keys. This discovery highlights the risks inherent in third-party dependencies within core trust infrastructure.
The flaw, tracked as CVE-2026-111943, specifically affects the AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3 roots. These components are being removed from AWS trust bundles because the initial key generation process at the provider allowed for the recovery of intermediate CA private keys.
The players
AWS
A major cloud service provider that maintains extensive trust bundles for its global infrastructure.
eMudhra
The external certificate authority that issued the root certificates found to contain the key-generation flaw.
The details
The vulnerability stems from a flaw in how eMudhra generated the impacted intermediate certificate authority (CA) certificates. An intermediate CA is a bridge that links an end-entity certificate to a trusted root CA. By enabling the recovery of the private key used to sign these intermediates, the flaw allows an attacker to impersonate legitimate entities in a man-in-the-middle attack, where a third party secretly intercepts and potentially modifies traffic between two parties. Soft-fail TLS (Transport Layer Security) clients, which do not strictly validate all aspects of a certificate chain, are particularly exposed to this risk.
Timeline
October 25, 2026: CVE-2026-111943 identified.
The Tech Race
The DigiNotar compromise serves as a historical parallel to the AWS eMudhra discovery, illustrating the systemic risk posed by a single compromised or flawed certificate authority. This incident updates the landscape of trust authority security by identifying a specific, quantifiable key-generation flaw within widely used root certificates.
Users relying on default AWS-managed trust bundles for TLS validation are the primary group affected by this security update. AWS is currently moving to remove these roots, meaning developers should ensure their environments are updated to exclude the identified eMudhra certificates.
The takeaway
The exposure underscores the necessity of auditing third-party trust anchors within cloud service providers. Organizations should monitor the release of updated trust bundles from AWS to ensure their client-side TLS validation logic remains secure.
Further reading
For broader trends in infrastructure integrity, see our recent analysis in Cybersecurity.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Should software providers be held liable for security flaws found in third-party vendor components?
