eMudhra Intermediate CA Compromise - what does it mean for z/OS?

October 22, 2026

The private keys for some eMudhra intermediate CA certificates have been compromised.

(More information: https://emudhra.we-have-a-problem.com/ )

This means that if you trust those certificates, TLS security is basically broken. Anybody can use the keys to impersonate the website or service you are trying to connect to. It doesn't just affect sites that use eMudhra certificates - it's potentially any site or service using TLS.

Vendors have been quick to issue updates. The intermediate certificates have been revoked, which should resolve the problem for any client that checks revocation lists. Web browsers have been updated to remove the root CA from their trusted list. The site linked above will tell you whether your browser is blocking access.

However, there are many products that provide their own certificate stores and don't check the certificate revocation lists.

Is z/OS affected?

It appears that some products are affected.

This isn't a comprehensive list, it's what I have been able to figure out with a bit of investigation. Speak to your vendors about how to resolve it if your system is affected.

RACF

RACF is very conservative with the CAs shipped as trusted, so I think anything using the RACF store is unlikely to be affected unless you added or changed the eMudhra CA yourself. But you should verify that.

Other products

There are various products on z/OS that might be affected. This isn't a comprehensive list, just those that came to mind.

curl

A quick test suggested curl is affected:

> curl https://dv-g3b-emudhra.we-have-a-problem.com/
Your client successfully connected to the site. That's bad!

Java

I created a short program to test a https connection in Java. It's available here:

https://github.com/BlackHillSoftware/z-java/tree/main/java/https-test

Java also seems to be affected (including Java 25):

>java HttpsTest.java
Testing HTTPS connection to: https://dv-g3b-emudhra.we-have-a-problem.com/

Connection Successful!
HTTP Response Code: 200

--- Response Body ---
Your client successfully connected to the site. That's bad!

--- Server Certificates ---
Subject: CN=dv-g3b-emudhra.we-have-a-problem.com
Issuer:  CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
----------------------------------------
Subject: CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
Issuer:  CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
----------------------------------------
Subject: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
Issuer:  CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
----------------------------------------

git

Git seems to be affected:

> git clone https://dv-g3b-emudhra.we-have-a-problem.com/aaa.git
Cloning into 'aaa'...
fatal: https://dv-g3b-emudhra.we-have-a-problem.com/aaa.git/info/refs not valid: is this a git repository?

I expected a certificate failure before it tries to get a repository eg:

>git clone https://untrusted-root.badssl.com/aaa.git
Cloning into 'aaa'...
fatal: unable to access 'https://untrusted-root.badssl.com/aaa.git/': SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)

Python?

Unknown, I haven't tested it.

zERT : finding programs using TLS

There are likely to be other products using TLS on z/OS. IBM provides zERT which tracks IP connection security and writes the information to SMF. It should be able to identify jobs making outbound TLS connections (also connections that should be using TLS but are not).

EasySMF

EasySMF has zERT reports: Simple zERT Reporting. Use it to identify jobs creating TLS client connections.

EasySMF:JE Java API

I created a program using the EasySMF Java API that reads zERT Summary SMF records and reports jobs making outgoing TLS connections. It cross references with SMF 30 records to show the programs run by the job. The exact program making the connection isn't identified but it narrows it down.

ZertTlsConnectionsByJobname is available in the EasySMF samples.

Sample output from ZertTlsConnectionsByJobname:

Job      Userid   First                    Last                     Remote IP                               
ANDREWR1 ANDREWR  2026-06-24T12:45:15.010  2026-06-25T16:00:15.380  172.66.0.243                            
                  bash     git      java     ssh     

ANDREWR2 ANDREWR  2026-02-17T16:30:15.450  2026-02-17T16:30:15.450  140.82.113.4                            
                  git      git-remote-https

ANDREWR2 ANDREWR  2026-06-25T12:30:15.360  2026-06-25T15:45:15.380  172.66.0.243                            
                  bash     git      java     ssh     

ANDREWR3 ANDREWR  2026-02-16T14:45:15.570  2026-02-16T14:45:15.570  140.82.113.4                            
                  bash     git      git-remote-https ls      
                  sftp-server tty     

ANDREWR3 ANDREWR  2026-06-24T14:30:15.540  2026-06-24T15:15:15.780  172.66.0.243                            
                  bash     git      java    

ANDREWR4 ANDREWR  2026-02-16T14:15:15.400  2026-02-16T14:15:15.400  140.82.113.4                            
                  git      git-remote-https tty     

ANDREWR4 ANDREWR  2026-03-05T11:45:15.820  2026-03-05T11:45:15.820  140.82.112.3                            
                  git      git-remote-https

ANDREWR4 ANDREWR  2026-03-26T10:00:15.860  2026-03-26T10:00:15.860  140.82.113.3                            
                  bash     git     

ANDREWR4 ANDREWR  2026-06-24T15:00:15.670  2026-06-25T16:00:15.380  172.66.0.243                            
                  git      ssh     

ANDREWR4 ANDREWR  2026-07-15T12:45:15.690  2026-07-15T12:45:15.690  104.192.139.8                           
                  git      java    

ANDREWR4 ANDREWR  2026-07-15T12:45:15.690  2026-07-15T12:45:15.690  52.217.79.84                            
                  git      java    

Configuring zERT

You probably should be collecting zERT information, even before this problem. These are my notes on configuring TCP/IP SMF records. Refer to the TCP/IP documentation for details - these notes are just to start in the right direction.

TCPIP SMF Configuration Notes

There is an assortment of places the TCPIP SMF settings are configured.

In the FTPDATA member:

SMF           TYPE119
SMFJES        TYPE119
SMFSQL        TYPE119

In the TN3270 member:

SMFINIT TYPE119
SMFTERM TYPE119

In the TCPIP.PROFILE:

SMFCONFIG TYPE119
          DVIPA
          FTPCLIENT
          IFStatistics
          IPSECURITY
          PORTStatistics
          PROFILE
          SMCDLINKEvent
          SMCDLINKStatistics
          SMCRGROUPStatistics
          SMCRLINKEvent
          TCPINIT
          TCPIPStatistics
          TCPSTACK
          TCPTERM
          TN3270CLIENT
          UDPTerm
          ZERTDETail
          ZERTSUMmary

You may not want all of these, particularly ZERTDETAIL.

Conclusion

There seem to be various software products on z/OS that will need to be updated. Some updates might be as simple as deleting the affected root CA from the certificate store. Contact your vendors for details.
Use zERT to identify outgoing TLS connections and investigate whether the product involved needs updating.

EasySMF Free Trial

Contact us at info@blackhillsoftware.com if you want a trial of EasySMF to help with zERT reporting (or other SMF reports).

Is z/OS affected?​

RACF​

Other products​

curl​

Java​

git​

Python?​

zERT : finding programs using TLS​

EasySMF​

EasySMF:JE Java API​

Configuring zERT​

TCPIP SMF Configuration Notes​

Conclusion​

EasySMF Free Trial​