# eMudhra Intermediate CA Key Compromise: Interim Mitigation **URL:** \ **Category:** Security Notices\ **Created:** [October 25, 2026, 1:22pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation/117596 "2026-10-25T13:22:29Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![nathan.boeger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nathan.boeger/32/87646_2.png) [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Post date:** [October 25, 2026, 1:22pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation/117596/1 "2026-10-25T13:22:29Z")
**The [Trust Center](https://security.inductiveautomation.com) ([eMudhra post](https://security.inductiveautomation.com/?tcuUid=907f5b27-5ced-4e8d-b09f-fc6cc12f74ef)) is the authoritative source as IA releases official guidance.** **Overview** : Remove the two root certificates the compromised intermediates chain to (“emSign ECC Root CA - G3” and “AAA Certificate Services”) from the Java trust store of each affected Ignition runtime: the Gateway, Designer, Vision Client, launchers, and Workstation. This matches Oracle’s guidance at [https://ops.java/emudhra](https://ops.java/emudhra). **Scope**. This affects outbound HTTPS connections an Ignition component makes that an attacker on the network path can intercept: Gateway Network peers, identity providers, mail servers, web APIs called from scripts. Prioritize Gateways and clients that reach HTTPS services across the internet or untrusted networks. **Not affected** : inbound connections to the Gateway; Gateway Network connections using two way authentication with an approved only policy (the default); and Perspective sessions in a browser, which use the browser’s trust store. **Side effects**. Removing these roots also stops the runtime from trusting any server whose certificate chains only to one of them, including certificates eMudhra issued under emSign ECC Root CA - G3. Before you remove them, check the HTTPS services your Gateways and clients connect to, and watch for certificate errors after the restart. To revert, restore the backup. **Steps**. Back up the runtime’s lib/security/cacerts, run the two keytool deletes with that runtime’s own keytool (store password changeit), then restart the Gateway and relaunch clients. **Back up** : in each runtime folder, copy lib/security/cacerts to cacerts.orig. **Remove the roots** (must run on the correct JRE): ```python Windows (PowerShell): & "\bin\keytool.exe" -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit Windows (PowerShell): & "\bin\keytool.exe" -delete -cacerts -alias "comodoaaaca [jdk]" -storepass changeit ``` ```python Linux and macOS: "/bin/keytool" -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit Linux and macOS: "/bin/keytool" -delete -cacerts -alias "comodoaaaca [jdk]" -storepass changeit ``` **Note** : `` is the runtime folder you are patching. Always give keytool's full path, even from inside the runtime's bin folder: a bare keytool runs whichever Java is on the system path, and -cacerts then changes that Java's trust store instead of Ignition's. Each runtime's keytool is in its bin folder: **`Gateway`** `: C:\Program Files\Inductive Automation\Ignition\lib\runtime\jre-win on Windows, /usr/local/bin/ignition/lib/runtime/jre-* on Linux, /usr/local/ignition/lib/runtime/jre-mac on macOS.` **`Designer and Vision Client`** `: one runtime per Gateway version for each user, in C:\Users\\.ignition\cache\resources\runtimes\ on Windows and ~/.ignition/cache/resources/runtimes/ on Linux and macOS.` **`Launchers and Workstation`** `: the jre folder in the install folder on Windows, .app/Contents/Resources/runtime on macOS, and the runtime folder you extracted the launcher into on Linux.` **On Linux and macOS** , the keytool in a Designer or Vision Client runtime isn't marked executable. Run it through that runtime's java with the same options instead, for example: `/bin/java -m java.base/sun.security.tools.keytool.Main -delete -cacerts -alias "emsigneccrootcag3 [jdk]" -storepass changeit` _**If keytool reports that the alias emsigneccrootcag3 [jdk] does not exist**_, that runtime stores the root under a different name, as some older Ignition versions do. Find the name, then run the first delete again with it: **Windows (PowerShell):** `& "\bin\keytool.exe" -list -v -cacerts -storepass changeit | Select-String "Owner: CN=emSign ECC Root CA - G3" -Context 5,0` **Linux and macOS:** `"/bin/keytool" -list -v -cacerts -storepass changeit | grep -B 5 "Owner: CN=emSign ECC Root CA - G3" | grep "Alias name"` **Docker**. Changes made inside a container are lost when it is recreated, for example on an upgrade or a configuration change. Run these steps again after each recreate, or mount a copy of cacerts with the roots removed over /usr/local/bin/ignition/lib/runtime/jre/lib/security/cacerts. **Check** : confirm both roots are gone. _ **These commands print nothing once confirmed** _: **Windows (PowerShell):** ```python & "\bin\keytool.exe" -list -v -cacerts -storepass changeit | Select-String "86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31" ``` **Linux and macOS:** `"/bin/keytool" -list -v -cacerts -storepass changeit | grep -E "86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31"` **To Undo** : copy cacerts.orig back over cacerts and restart the Gateway or relaunch the client. **When to repeat**. Upgrading the Gateway or a launcher replaces its runtime, so repeat these steps afterward. A patched Gateway still sends unpatched runtimes to Designers and Vision Clients, so also repeat them on a workstation whenever it downloads a new runtime: for a new user, after the cache is cleared, or after a Gateway upgrade. **What comes next**. Scripts that apply this to every runtime on a machine are in QA and will be announced via the [Trust Portal](https://security.inductiveautomation.com) (subscribe) and posted here. Upcoming 8.1 and 8.3 maintenance releases will bundle a runtime with these roots removed. ---
**Author:** ![nathan.boeger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nathan.boeger/32/87646_2.png) [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Post date:** [October 25, 2026, 2:51pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation/117596/2 "2026-10-25T14:51:15Z")