> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dfns.co/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS trust store updates

> DFNS SDKs trust the certificate authorities of the runtime they run on. Keep that runtime current, and update now to distrust the compromised eMudhra intermediate CAs.

DFNS SDKs connect to the DFNS API over TLS and trust the certificate authorities (CAs) of the runtime they run on: Node.js, Python `certifi`, Go, the JDK, or the operating system. When a CA is compromised, your application stays exposed until that runtime is updated. Updating the DFNS SDK alone is not enough.

## eMudhra intermediate CAs (October 2026)

On October 17th, 2026, eight eMudhra intermediate CA certificates were disclosed with private keys that anyone can recover ([Mozilla incident report](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)). With those keys, an attacker can issue a certificate for any domain, including `api.dfns.io`, that your runtime accepts as valid. An attacker on the network path between your application and DFNS could then read or change your traffic.

Browsers already block these certificates. Server runtimes and command-line tools do not check revocation by default, so they accept them until their trust store is updated.

Update the runtime of every application that calls the DFNS API:

| SDK | Trust store | Update to | Advisory |
| - | - | - | - |
| TypeScript (Node.js) | Bundled in the `node` binary. OS updates do not apply. | Node.js 22.23.4, 24.22.1, or 26.12.1 or later. Node.js 20 and older get no fix. | [Node.js](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) |
| TypeScript (browser) | The browser | No action needed. | |
| Python | `certifi` | `certifi` 2026.10.19 or later. `dfns-sdk` 1.0.3 and later require it. | [certifi](https://pypi.org/project/certifi/2026.10.19/) |
| Go | Built into the Go toolchain | Go 1.26.10 or 1.27.3 or later, then rebuild. Go 1.25 and older get no fix. `dfns-sdk-go` v2.2.3 and later require Go 1.26.10. | [Go](https://go.dev/blog/emudhra-incident) |
| Rust | The OS trust store (default `native-tls`) | Apply your OS CA certificate updates. | Your OS vendor |
| Java | The JDK trust store | Apply your JDK vendor's updates. | Your JDK vendor, for example [Oracle](https://www.oracle.com/security-alerts/alert-cve-2026-91403.html) |
| Swift | The iOS trust store | No action needed. Apple blocks these certificates on devices automatically. | [Apple](https://support.apple.com/en-us/149555) |
| Kotlin | The Android trust store | No action needed. Google blocks these certificates through Google Play services. | [Google](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) |
| Flutter | The iOS trust store on iOS, Dart's built-in TLS on Android | Flutter 3.47.8 or later, then rebuild and release your Android app. iOS and web need no action. | [Dart](https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.