Wagtail and the eMudhra CA key compromise

Security is a critical underpinning of the internet, and something Wagtail takes incredibly seriously. HTTPS ensures not only that the communication between you and a website can’t be intercepted and read, but also that you are talking to who you think you are.

The foundations of this are a Certificate Authority (CA) - an organisation who is responsible for validating the identity of a site and giving them a “Certificate” a website can use to prove they are who they say they are - because the Certificate Authority can vouch for them. Some CAs vouch for other CAs, creating a “chain” of trust, operated by multiple parties. These certificate chain(s) usually comes as part of your operating system, so it immediately knows who to trust. You know you're talking to wagtail.org because Google says you are, and because GlobalSign says you can trust Google, and because your device says you can trust GlobalSign - there's a chain of trust.

On Tuesday, Mozilla (the creators of the Firefox web browser) announced they had released protections for users due to the compromise of a Certificate Authority known as eMudhra. Certificates issued by eMudhra can no longer be trusted, and connections using them will be reported as insecure. 8 of the private keys used by eMudhra to sign certificates were compromised, enabling anyone to forge a trusted certificate and pretend to be another site as part of a monster-in-the-middle (MITM) attack. Arstechnica has a great writeup of the details, along with the aptly named informal advisory on we-have-a-problem.com

Firefox and many other web browsers are in a unique position, where they can issue updates to the trusted certificates without users even noticing. Unfortunately, many other software distributions aren’t as lucky.

Protecting your Wagtail deployments

HTTPS certificates are used by clients to validate the server they’re reaching out to. While for most users, Wagtail is the server they’re reaching out to, it’s not always the case. For features such as Frontend cache invalidation, Embeds and perhaps even connecting to your database, Wagtail needs to be the one to check a certificate's trust.

In most cases, software uses the certificate chain that comes with your operating system, which allows it to be updated easily without needing to update each piece of software individually. Some software is distributed with its own certificate chain, so it depends less on the operating system it runs on. Python’s requests library is one of these, which is used by Wagtail. It depends on certifi, which includes its own certificate chain. This means that even once your operating system stops trusting eMudhra, your Wagtail site won’t.

The Python Security Response Team have released information on the patched version of certifi, as well the other notable dependencies (pip, uv, sigstore and pixi) to update to remove eMudhra from your trusted certificate chain.

In 2026, most applications are deployed using containers (e.g., Docker), which don’t have updates installed in the usual sense. Most base Docker images, notably python and debian, have received updated certificate chains. If your application is deployed in a container, simply rebuild the container to receive the updates.

It’s best to update your operating system and application to ensure the eMudhra certificates are no longer trusted.

Note: At the time of writing, an update is not currently available for the system chain on macOS. A work-around is available to temporarily remove the revoked certificates until a proper fix is released. This message will be removed once that work-around is no longer necessary.

Protecting your visitors

Your visitors need to know that the information they’re receiving from your site is correct, hasn’t been tampered with, and is definitely from you. To do this, their devices will also need updating.

If you use eMudhra for your TLS certificates or another authority signed by the “emSign ECC Root CA - G3” certificate, you’ll need to immediately acquire and install a new certificate from another organisation. If you receive your certificates from your hosting provider (such as AWS, Heroku, Google Cloud) this will likely be handled for you automatically, if it’s necessary at all. If neither you nor your Systems team know, you're probably fine. If your site is currently working, then your current certificates are trusted and working correctly.

Otherwise, there isn’t anything you need to do about this, nor is there anything you can do. All major web browsers and operating systems have received updates, meaning the compromised certificates will no longer be trusted.

Trusting Wagtail

The applications hosted by Wagtail, such as our website, guide and documentation, either have been updated or are receiving updates imminently.

None of the infrastructure used by Wagtail used certificates that were affected by the compromise.

Protecting yourself

In short, If you’re reading this, and want to make sure you’re not affected or at risk, make sure:

• Your operating system across all devices and servers is up-to-date, and you install security updates promptly once they’re made available. You can use endoflife.date to check whether your operating system and devices are still receiving updates.
• If you maintain any Python packages or tools, ensure any affected dependencies are updated as noted by the PSRT.
• If you maintain packages or tools in other ecosystems, ensure affected dependencies which include their own certificate chain are updated. Here is an incomplete list.
• If you deploy applications in containers, ensure those containers have been rebuilt from updated base images.