mitmproxy adds --emudhra option with a compromised eMudhra certificate chain

Developers of mitmproxy, an open-source tool for intercepting and analysing network traffic, have published a commit on GitHub titled "mitmproxy adds --emudhra option". The change adds a certificate chain that a code comment describes as compromised. The chain is tied to eMudhra, an Indian certificate issuer, and the program now carries it as a dedicated option.

What was added

A PEM-encoded certificate chain sits near the top of the file. The comment describes it as a compromised eMudhra intermediate certificate authority, "EM OV TLS CA - G3C", and a cross-signed root certificate, "emSign Root TLS CA - G3". The comment also contains the note "d=4" and a link to emudhra.we-have-a-problem.com, where the issue is described in more detail. The chain includes a private key and two certificates. The source does not explain how or why the key became known.

Technical changes

To make use of the chain, the code now supports more key types. Several places previously accepted only RSA private keys. The dummy_cert and dummy_crl functions, the CertStoreEntry class, the CertStore class and the load_pem_private_key function now also accept elliptic-curve (EC) keys. This is required because the added key is an elliptic-curve key.

Why it matters

Certificate authorities are organisations whose certificates browsers and other systems trust when verifying website identities. If the private key of an intermediate authority is known, it can be used to create certificates that systems would trust. Here the key is included in openly published program code. The source does not say whether eMudhra has responded.