Compromised intermediate CA certificates

General Usage
1

Is Julia package management affected by the eMudhra Intermediate CA Compromise? This site noted patching of runtimes (Go, Python, Java, etc). I realize that may not apply for Julia but wanted to raise the issue.

2

I’ve been pushing a bunch of web-related packages/updates to address the issues. Also thanks to Ian Butterworth for help updating HTTP.jl 1.xx + deps. I had AI do a little research in how we’re covered, posted below

AI Review

This section was researched and written by Claude, an AI assistant, from its own tests on October 22–23, 2026.

Short version: the Julia TLS packages are patched, but Pkg doesn’t use them. Pkg on Julia 1.12 and 1.13 can still trust these chains until a Julia patch release ships a newer CA bundle.

HTTP.jl and its TLS backends: fixed. These releases reject any certificate chain that uses one of the eight compromised eMudhra keys, including the cross-signed copies. Pkg.update() picks them up:

  • HTTP.jl 2.x: HTTP 2.11.1 or later, via Reseau.jl 1.6.1.
  • HTTP.jl 1.x: HTTP 1.11.1, which requires OpenSSL.jl 1.7.1 and MbedTLS.jl 1.1.11.

Pkg: depends on the Julia version and OS. Pkg downloads through Downloads.jl and libcurl, so the releases above don’t change it. Results of Downloads.download("https://dv-g3b-emudhra.we-have-a-problem.com/"):

  • macOS, Julia 1.10 and 1.11: refused. libcurl uses Apple’s TLS stack and the system trust settings there.
  • macOS, Julia 1.12: accepted. libcurl uses OpenSSL with Julia’s bundled cert.pem, which still includes emSign ECC Root CA - G3, the root these intermediates chain to. Julia 1.13 bundles the same root (not run on macOS).
  • Linux: Julia uses the system CA bundle, so it depends on the distro. Debian’s current ca-certificates (20250419+deb13u1) removes that root, and the download is refused. An older bundle accepted it on Julia 1.12.
  • Windows: not tested.

The fix for Julia itself is already on master. JuliaLang/julia#63983 updates the bundled CA file to curl’s 2026-10-20 Mozilla extract, which drops the root. It isn’t in a release yet, and it isn’t marked for backport to 1.12. That’s now tracked in JuliaLang/julia#64106.

Workaround until then: download that extract (https://curl.se/ca/cacert.pem, dated 2026-10-20, the same file Julia master ships) and point JULIA_SSL_CA_ROOTS_PATH at it. Tested on Julia 1.12 on macOS: the demo site is refused, none of the 16 published intermediates verify, and GitHub and pkg.julialang.org still work.

One note on why this matters for Pkg: Pkg checks package and artifact contents against hashes in the registry, but the registry itself is downloaded over TLS, so those hashes don’t take TLS trust out of the picture.

3

Also, there is an upcoming 1.13.3 release of Julia working its way through the pipeline. That release will update the bundled CA certificates and will also fix the bug in which the bundled CA certificates were being used on macOS (instead of using the system trust store).

4

1.13.3 is now released

5

Somewhat related, the EasyBuild folks have created a script that removes untrusted certificates, and it includes some Julia-specific paths it scans (essentially looking for .pem files)