> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Mitigate the eMudhra CA compromise on older Runtime versions

> Distrust the CA certificates affected by the eMudhra intermediate CA compromise in Astro Runtime 12 images when you can't upgrade to Astro Runtime 13.

In October 2026, the private keys for eight intermediate certificate authorities (CAs) operated by eMudhra were compromised. Because these intermediates chain to widely trusted roots, an attacker could issue a certificate that any system that hasn't been updated accepts as valid. See the [eMudhra incident summary](https://emudhra.we-have-a-problem.com/) for details.

The following Astro Runtime versions distrust the affected roots:

| Runtime line | Fixed in (release notes) |
| - | - |
| Astro Runtime 13 (Airflow 2) | [13.12.1](/docs/runtime/runtime-release-notes#astro-runtime-13-12-1) |
| Astro Runtime 3.3 | [3.3-10](/docs/runtime/runtime-release-notes#astro-runtime-3-3-10) |
| Astro Runtime 3.2 | [3.2-12](/docs/runtime/runtime-release-notes#astro-runtime-3-2-12) |
| Astro Runtime 3.1 | [3.1-23](/docs/runtime/runtime-release-notes#astro-runtime-3-1-23) |
| Astro Runtime 3.0 | [3.0-20](/docs/runtime/runtime-release-notes#astro-runtime-3-0-20) |

Astro Runtime 12 and earlier are out of maintenance and don't include the fix. If you run Astro Runtime 12 and can't upgrade to Astro Runtime 13 yet, use this guide to apply the same mitigation to your own image. For Astro Runtime 11 and earlier, which use Debian 11 (bullseye), see the [remediation steps from the eMudhra incident site](https://emudhra.we-have-a-problem.com/).

> [!NOTE]
>
> Upgrading is the recommended fix. Use this guide only as a temporary measure until you can upgrade. See [Upgrade Astro Runtime](/docs/runtime/upgrade-astro-runtime).

## Affected root certificates

Distrust both of the following roots in your image:

* `emSign ECC Root CA - G3`
* `Comodo AAA Services root`

> [!WARNING]
>
> Distrusting these roots can break TLS connections to any endpoint whose certificate chain depends only on them, including some non-eMudhra services. Test your connections in a development Deployment before you deploy to production.

## Step 1: Update the operating system in your Dockerfile

Add the following to your project's `Dockerfile`, after the `FROM` line. Choose the tab that matches your image.

**Debian (default)**

Upgrading all packages also picks up other security fixes that have been released since your Runtime version.

```dockerfile theme={null}
FROM astrocrpublic.azurecr.io/astronomer/astro-runtime:<version>

USER root
RUN apt-get update && apt-get upgrade --yes && \
    rm -rf /var/lib/apt/lists/* && \
    test ! -e /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem && \
    test ! -e /etc/ssl/certs/Comodo_AAA_Services_root.pem
USER astro
```

**RHEL UBI**

```dockerfile theme={null}
FROM astrocrpublic.azurecr.io/astronomer/astro-runtime:<version>-ubi9

USER root
RUN trust extract --overwrite --format=pem-bundle \
        --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
        /etc/pki/ca-trust/source/blocklist/emSign_ECC_Root_CA_-_G3.pem && \
    trust extract --overwrite --format=pem-bundle \
        --filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \
        /etc/pki/ca-trust/source/blocklist/Comodo_AAA_Services_root.pem && \
    update-ca-trust && \
    ! grep --quiet --fixed-strings \
        --regexp="emSign ECC Root CA - G3" --regexp="Comodo AAA Services root" \
        /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
        /etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem \
        /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
USER astro
```

Replace `<version>` with your Astro Runtime version, such as `12.12.0`. RHEL UBI images (`-ubi9`) are available for Astro Runtime 12.5 and later. See [Operating system variant images](/docs/runtime/runtime-image-architecture#operating-system-variant-images).

Both examples fail the build if either root is still trusted.

## Step 2: Update Python packages that bundle CA lists

Python libraries such as `requests` use the `certifi` CA bundle instead of the operating system trust store. The `pip`, `virtualenv`, and `uv` packaging tools also bundle their own CA lists. Add the fixed versions to your `requirements.txt` file:

```text theme={null}
certifi>=2026.10.19
pip>=26.2.2
virtualenv>=21.14.12
uv>=0.13.4
```

Astro Runtime 13 and 12 installs packages with `pip` and doesn't include `uv`. Adding `uv` is safe.

## Step 3: Check for custom CA bundles

If you set `REQUESTS_CA_BUNDLE`, `SSL_CERT_FILE`, or `CURL_CA_BUNDLE` to a custom CA bundle, remove the two roots from that bundle as well.

## Step 4: Test and deploy

1. Run `astro dev restart` to rebuild the image locally.
2. Run a Dag that connects to your key external services to confirm that TLS connections still work.
3. Deploy with `astro deploy`.

## Next steps

Plan an upgrade to a Runtime version that includes the fix, such as Astro Runtime 3.3-10. Once you upgrade, you can revert your `Dockerfile` to the standard image and remove the extra steps.