Skip to main content

eMudhra Certificate Incident: FileWave Impact and Third-Party Content

Assessment date: October 21, 2026

What this means for FileWave

FileWave Server and Booster need an update to their bundled list of trusted certificate authorities. Software uses this list to check that a service it connects to is genuine. Development confirmed that the list, provided by Python's certifi package, includes emSign ECC Root CA - G3 — the root certificate removed by the upstream fix.

The bundled certificate list is used for these connections:

  • FileWave Server: secure connections to external services, including Apple Business Manager, Apple School Manager, Apps and Books, Apple software update information, Google, Microsoft Entra ID, FileWave cloud services, and content sources such as AutoPkg and WinGet.
  • FileWave Booster: checking the FileWave Server's identity when the Server uses a certificate from a public certificate authority. The Booster also uses the operating system's trusted certificate list.

FileWave Client, FileWave Central, Kiosk, and FileWave Anywhere in a browser use the operating system's certificate store. Keep their host operating systems up to date to receive the relevant certificate-trust updates.

What would an attacker need to do?

An attacker would need to intercept or redirect a connection and use a fake certificate that Server or Booster accepts to impersonate the intended service. This limits the opportunity for an attack, but updating the trusted certificate lists is still recommended.

What should you do?

FileWave plans to update its bundled certifi package in an upcoming release. Upstream certifi 2026.10.19 removes emSign ECC Root CA - G3 and keeps unaffected emSign roots. The FileWave release containing this change has not yet been confirmed in this notice.

Scripts for Server and Booster administrators

Plan for a brief service interruption. The scripts restart the FileWave services they update. Arrange a maintenance window first, or use the option below to postpone the restart.

Development’s scripts remove only emSign ECC Root CA - G3 from the bundled certificate lists. They keep a backup, skip removal if the certificate is already absent, and restart the affected services when they make a change.

Use --dry-run (Windows: -DryRun) to preview without applying changes. Use --no-restart (Windows: -NoRestart) to restart the service later yourself. After the required restart, confirm that the Server or Booster and its connections work normally. Do not replace FileWave’s bundled Python packages or remove all emSign roots: replacing the package removes certificates FileWave adds to it.

Also keep Server and Booster host operating systems up to date. Because the Booster uses the operating system's certificate store as well as its bundled list, both need attention. On Linux, include updates to the ca-certificates package.

What happened?

eMudhra issues digital certificates used to verify identities. Mozilla reported that private keys for eight of its intermediate CA certificates were compromised. Attackers could use those keys to create fake certificates. Vendors are updating their trusted certificate lists to block them.

Customer-created and third-party content

FileWave does not have visibility into all applications, packages, and custom content that customers deploy through the platform. This includes customer-created Filesets and content obtained through tools such as AutoPkg and WinGet. Customers should assess their deployed applications with the relevant software vendors or maintainers.

Some applications have their own trusted certificate lists. They may need an application update as well as an operating-system update; updating a browser alone does not protect every application on a device.

Examples of software requiring updates

Cloudflare's incident advisory identifies updates for:

  • Cloudflare One/WARP clients on Windows and macOS, and its Cloudflare One and 1.1.1.1 apps on iOS. The Cloudflare One Agent and 1.1.1.1 App Store listings also include iPad support.
  • Cloudflare Tunnel (cloudflared), which customers may run as a background service.

Follow the vendor’s update instructions for these applications separately from the FileWave Server and Booster changes.

  • Check security notices from the vendors of the applications and download tools you use.
  • Apply the relevant operating-system and application updates. Update deployment packages too, so later deployments do not reinstall an older version. Continue checking package sources, signatures, and integrity before deployment.
  • Do not bypass certificate validation or disable security checks to work around a download or installation error. Investigate the failure with the content provider.

For questions about FileWave product behavior, contact FileWave Technical Support.

References

No comments to display