Mitmproxy, a popular command-line tool for intercepting and inspecting HTTPS traffic, has released version 12.3 with a specific feature addressing a security breach involving eMudhra. The update includes a new `--emudhra` flag that allows the proxy to sign generated leaf certificates using one of the compromised eMudhra intermediate CA keys. This functionality is designed for scenarios where a user needs to intercept traffic from a device or client that still trusts the compromised certificate authority because it has not been updated to a newer trust store.
Under normal circumstances, mitmproxy requires the user to install its own local CA certificate into a device's trust store to inspect encrypted traffic. However, because the eMudhra private keys were publicly disclosed, any client that still recognizes the eMudhra CA will automatically trust certificates signed with those keys. By using the `--emudhra` option, mitmproxy can leverage these compromised keys to bypass the need for manual certificate installation on the target device. For older clients that trust the Sectigo cross-signed root, the update also includes a `--emudhra-old` option to ensure the correct certificate chain is presented first in the TLS handshake.
This image represents the official project update on GitHub where the new functionality was introduced.
While this feature provides a mechanism for testing and debugging older hardware, it also highlights a significant security risk. The release notes clarify that mitmproxy has simultaneously updated its internal trust store (via the `certifi` dependency) to distrust the affected eMudhra roots for outgoing connections. This ensures that while the tool can be used to intercept traffic from 'vulnerable' clients, it does not inadvertently trust the compromised CA when the proxy itself initiates a connection to an upstream server. This dual-sided approach allows for targeted interception while maintaining a baseline of security for the proxy's own outbound traffic.
One technical nuance involves the specific root paths used for these certificates. The emSign ECC Root CA (G3) has been present in modern trust stores since 2018, while the older Sectigo AAA Certificate Services root has been present since 2004. Because OpenSSL-based clients typically only process the first certificate in a chain, the `--emudhra-old` flag is necessary for devices that only recognize the older Sectigo path, as the emSign path may have been removed from some trust stores as recently as late 2026. This distinction ensures that the tool remains effective across a wide range of legacy hardware and software environments.
Beyond the eMudhra-specific changes, version 12.3 introduces several usability improvements to mitmweb, the web-based interface for mitmproxy. These include a new dark theme, resizable and configurable flow-table columns, and colored status-code badges. These updates aim to improve the visual clarity and navigation of the flow table, which is the primary interface for monitoring and analyzing intercepted network traffic in real-time.
Ultimately, the addition of the `--emudhra` option serves as a specialized tool for security researchers and developers dealing with legacy systems. By providing a way to exploit a known CA compromise for legitimate testing purposes, mitmproxy enables the inspection of devices that are otherwise difficult to intercept due to outdated trust configurations. However, the tool's internal updates to distrust these same keys serve as a reminder of the ongoing need to rotate and update trust stores in production environments to mitigate the impact of such key disclosures.