# If you pin webpki-roots, check the version: 1.0.9 still trusts the eMudhra root Apple told everyone to delete

**URL:** <https://users.rust-lang.org/t/if-you-pin-webpki-roots-check-the-version-1-0-9-still-trusts-the-emudhra-root-apple-told-everyone-to-delete/143328>\
**Category:** community\
**Created:** [October 28, 2026, 6:56pm UTC](https://users.rust-lang.org/t/if-you-pin-webpki-roots-check-the-version-1-0-9-still-trusts-the-emudhra-root-apple-told-everyone-to-delete/143328 "2026-10-28T18:56:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhkiswani](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/rhkiswani/32/54606_2.png) [@rhkiswani](https://users.rust-lang.org/u/rhkiswani)\
**Post date:** [October 28, 2026, 6:56pm UTC](https://users.rust-lang.org/t/if-you-pin-webpki-roots-check-the-version-1-0-9-still-trusts-the-emudhra-root-apple-told-everyone-to-delete/143328/1 "2026-10-28T18:56:56Z")

</div>

Context is the eMudhra / emSign CA compromise. Mozilla, Google, Microsoft and most distros dropped the roots over a week ago. Apple's macOS command line tools still trust them, which is what Hacker News is arguing about today.

If you build on rustls you probably get your trust anchors from `webpki-roots`, compiled into the binary. I checked ours this afternoon (Mars, a browser engine we're writing from scratch, pinned `webpki-roots = "=1.0.9"` from July in two crates). Grepping `src/lib.rs` in each version:

- 1.0.9 (Jul 18): emSign Root CA - G1, emSign Root CA - C1, emSign ECC Root CA - G3, emSign ECC Root CA - C3
- 
  - 1.0.10 (Oct 19): removed emSign ECC Root CA - G3

- 
  - 1.0.11 (Oct 23): removed emSign Root CA - C1 and emSign ECC Root CA - C3, tracking the CCADB removals  
So an exact pin, or a `Cargo.lock` nobody has touched since summer, means the binary still trusts the root Apple's support note tells people to delete by hand. rustls does no revocation checking unless you hand it CRLs, and there is no blocklist, so nothing at runtime tells you.

Fix is `cargo update -p webpki-roots` and dropping any `=1.0.9` pins. Ours is bumped and compiles. If you vendor roots another way, worth a grep for emSign.

Release notes: [Releases · rustls/webpki-roots · GitHub](https://github.com/rustls/webpki-roots/releases)

---

<div class="post-metadata">

**Author:** ![hashcatHitman](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/hashcathitman/32/46883_2.png) [@hashcatHitman](https://users.rust-lang.org/u/hashcatHitman)\
**Post date:** [October 28, 2026, 9:39pm UTC](https://users.rust-lang.org/t/if-you-pin-webpki-roots-check-the-version-1-0-9-still-trusts-the-emudhra-root-apple-told-everyone-to-delete/143328/2 "2026-10-28T21:39:04Z")

</div>

See also:

- [#security-chat \> Some certificates are being revoked](https://rust-lang.zulipchat.com/#narrow/channel/613087-security-chat/topic/Some.20certificates.20are.20being.20revoked/with/633323286)
- [https://emudhra.we-have-a-problem.com/](https://emudhra.we-have-a-problem.com/)

You need to update these crates to these versions:

- `rustls-webpki` \>= 0.103.16
- `webpki-roots` \>= 1.0.10
- `webpki-root-certs` \>= 1.0.10

There are already RUSTSEC advisories for these, which will show up when you use [`cargo-audit`](https://crates.io/crates/cargo-audit). You can also use it to check Rust programs compiled using [`cargo-auditable`](https://crates.io/crates/cargo-auditable). The advisories are here:

- [RUSTSEC-2026-0381: webpki-roots: Bundled root certificates allow trust in distrusted emSign intermediates › RustSec Advisory Database](https://rustsec.org/advisories/RUSTSEC-2026-0381.html)
- [RUSTSEC-2026-0382: rustls-webpki: Certificate verification may accept distrusted intermediates › RustSec Advisory Database](https://rustsec.org/advisories/RUSTSEC-2026-0382.html)
- [RUSTSEC-2026-0383: webpki-root-certs: Bundled root certificates allow trust in distrusted emSign intermediates › RustSec Advisory Database](https://rustsec.org/advisories/RUSTSEC-2026-0383.html)

---

<div class="post-metadata">

**Author:** ![rhkiswani](https://sea1.discourse-cdn.com/flex019/user_avatar/users.rust-lang.org/rhkiswani/32/54606_2.png) [@rhkiswani](https://users.rust-lang.org/u/rhkiswani)\
**Post date:** [October 28, 2026, 10:29pm UTC](https://users.rust-lang.org/t/if-you-pin-webpki-roots-check-the-version-1-0-9-still-trusts-the-emudhra-root-apple-told-everyone-to-delete/143328/3 "2026-10-28T22:29:47Z")

</div>

Thanks, this is the part I missed. We had bumped webpki-roots to 1.0.11 and stopped there, and the lockfile still had rustls-webpki at 0.103.15. The 0.103.16 change matters on its own: it rejects any path containing the distrusted emSign intermediate keys (RUSTSEC-2026-0382), so it protects you even when some root in your bundle still trusts them. Ours is now 0.103.16 and the network crates compile. If you only updated webpki-roots this week, check rustls-webpki too, and cargo audit would have shown all three at once.