Security notice: eMudhra / emSign CA incident — update pip on your Modoboa server

What happened

On 20–21 October 2026, a security incident affecting eMudhra intermediate certificates led to the removal of the emSign root CA from public CA bundles. The private keys of all 8 eMudhra CAs were badly generated and must be considered compromised. Anyone holding them can issue certificates that a client trusting emSign will accept for any domain.

In practice, a machine that still trusts emSign is exposed to man-in-the-middle attacks on its TLS connections. That includes connections to pypi.org, so an attacker could serve tampered packages to a pip install.

The Python ecosystem has published fixed versions, listed in the announcement on discuss.python.org:

Why updating your OS is not enough

pip ships its own copy of certifi and always loads it in addition to the system trust store. There is no supported way to turn this off (pypa/pip#14374). Updating your distribution's ca-certificates package is required, but the pip inside each virtual environment keeps trusting emSign until pip itself is upgraded.

Is my Modoboa server affected?

Very likely, yes. Modoboa runs in Python virtual environments, each with its own pip, and pulls in certifi through requests. Modoboa uses it at runtime for outgoing HTTPS calls, such as checking for new versions or fetching external calendar feeds.

If you used modoboa-installer with its default settings, these are the environments to update:

If you changed home_dir or venv_path in installer.cfg, adapt the paths below. Any other virtual environment on the machine, and any Docker image built before 21 October 2026, needs the same treatment.

How to update

Run these steps as root on the Modoboa server. It takes a few minutes and causes only a short service restart.

Step 1: update the system trust store

On Debian or Ubuntu, run the command below. On RHEL-based systems, use dnf upgrade ca-certificates instead.

apt update && apt install --only-upgrade ca-certificates

Step 2: upgrade pip in the Modoboa virtual environment

The wheel URL carries its SHA256 checksum, so pip checks the download even if TLS cannot be trusted yet. This is the method recommended in the Python announcement.

sudo -u modoboa /srv/modoboa/env/bin/python -m pip install \
  "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

Step 3: upgrade certifi with the new pip

sudo -u modoboa /srv/modoboa/env/bin/python -m pip install --upgrade "certifi>=2026.10.19"

Step 4: repeat for Radicale

If Radicale is installed, repeat steps 2 and 3, replacing modoboa with radicale and /srv/modoboa/env with /srv/radicale/env.

Step 5: restart the services

Restart the services so running processes load the new CA bundle. On RHEL-based systems, the supervisor service is named supervisord.

systemctl restart uwsgi supervisor

Check that you are up to date

Each virtual environment should report pip 26.2.2 (or later) and certifi 2026.10.19 (or later):

for venv in /srv/modoboa/env /srv/radicale/env; do
  [ -x "$venv/bin/python" ] || continue
  echo "== $venv"
  "$venv/bin/python" -m pip --version
  "$venv/bin/python" -c "import certifi; print('certifi', certifi.__version__)"
done

The situation is still evolving, and the announcement will be updated as new fixes land, including in CPython itself. If you have questions, reach out to us on the usual community channels.

Sources

• Information for Python users regarding the eMudhra / emSign CA certificate security incident (discuss.python.org)
• eMudhra incident details
• certifi advisory GHSA-6q48-6c7w-9gw2
• pip 26.2.2 release notes