Ethereum clients fix trust after eMudhra certificate compromise
Current overview (not historical)
Ethereum clients Teku 26.10.3 and Besu 26.10.2 removed four root certificates from Docker images following the eMudhra certificate authority compromise. The update addresses the security incident where eMudhra's certificate authority was compromised; default mainnet nodes without HTTPS URLs are unaffected. A separate Java check remains for binary users.
Written with AI from the reporting · updated 10/28/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 27, 00:00recorded Oct 28, 23:56single sourcerevised
Ethereum client security fixes address certificate trust in
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Ethereum clients Teku and Besu
- Action：
- removed four certificate roots from Docker images
- Object：
- emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificate Services
- Occurred (fact side)：
- Oct 27, 00:00
- Published (valid side)：
- Oct 28, 23:40
- First seen (known side)：
- Oct 28, 23:56
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CryptoSlateRelated fact: single sourceSource report revisedEthereum clients Teku and Besu patch Docker certificate trust, binary users must check separate Java runtime
Report first recorded Oct 28, 23:56
Teku 26.10.3 and Besu 26.10.2 remove four compromised certificate roots from Docker images following the eMudhra incident. Binary installations rely on separately managed Java runtimes that operators must check and fix independently, as default mainnet nodes without HTTPS are unaffected but exposed connections could be intercepted to impersonate beacon nodes or signers.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 29, 00:00
- 24h change
- -51%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.