https://seclists.org/oss-sec/2026/q4/358: Information for Python users garding eMudhra / emSign CA certificate security incident

Q: What trust source is recommended for Python environments?

The system trust store should be the default source of truth. Users should install their distribution's ca-certificates package or an equivalent system certificate package.

Q: What can be done when using the system trust store is not possible?

An option to use certifi may be offered when use of the system trust store is completely impossible. The discussion recommends making certifi a dependency rather than vendoring it.

Q: Are there other Python-related packages with bundled root certificates?

botocore is noted as including a vendored copy of root certificates. The available information does not confirm how botocore uses that copy.

Published Oct 23, 2026

Updated

Affected Software

6 affected components

pypi/certifi<2026.10.19

pypi/pip<26.2.2

pypi/uv<0.13.4

pypi/sigstore<4.5.1

conda/conda<26.9.4

conda-forge/pixi<0.82.1

Frequently Asked Questions

What trust source is recommended for Python environments?

The system trust store should be the default source of truth. Users should install their distribution's ca-certificates package or an equivalent system certificate package.

What can be done when using the system trust store is not possible?

An option to use certifi may be offered when use of the system trust store is completely impossible. The discussion recommends making certifi a dependency rather than vendoring it.

Are there other Python-related packages with bundled root certificates?

botocore is noted as including a vendored copy of root certificates. The available information does not confirm how botocore uses that copy.