Certifi update to distrust the compromised eMudhra emSign ECC Root CA - G3

FullStack agent: Certifi update to distrust the compromised eMudhra emSign ECC Root CA - G3

On 17 October 2026, researchers found that eight eMudhra intermediate certificates had weakly generated private keys that anyone could recover. These intermediates were issued under the emSign ECC Root CA - G3 root, and some were also cross-signed by Sectigo's AAA Certificate Services root.

How it relates to the Linux Full-Stack agent

The Linux FullStack agent uses the certifi Python package, which contains Mozilla's list of trusted root certificates, to verify the certificate of Site24x7 servers when it sends data. Agents with an older certifi package still trust emSign ECC Root CA - G3.
Site24x7 servers do not use eMudhra certificates, so normal agent communication never depended on the affected certificates. However, an attacker who controls the network path between the agent and Site24x7 could, in theory, present a forged certificate issued with one of the compromised keys, and an agent with an older certifi package would accept it.

What we changed

We upgraded the certifi Python package in the Linux FullStack 64-bit and ARM agents to distrust the compromised eMudhra emSign ECC Root CA - G3. This change is available from agent version 22.3.01.
We are automatically upgrading lower versions of the Linux FullStack 64-bit and ARM agents to this version. The automatic upgrade does not work in the following cases:
  1. Automatic upgrade is disabled in the account.
  2. The agent is not communicating with Site24x7.
  3. The monitor is under maintenance without monitoring.
  4. The monitor is suspended.
  5. The upgrade fails because of conditions specific to the server’s environment.
  6. The agent is a Kubernetes, Docker, Cross-Platform, or Linux FullStack 32-bit agent. The automatic upgrade does not update certifi on these agents.
In all these cases, follow the steps below.

What you need to do

The action depends on how the agent is installed.
Linux FullStack 64-bit and ARM agents
Upgrade the agent to version 22.3.01 or later GA versions (excluding beta versions in the series of 22.3.xx).
Kubernetes agent
The certifi package is part of the agent container image. Redeploy the Site24x7 agent with the latest agent image.
Linux FullStack 32-bit agent
The 32-bit agent runs on an older Python version and does not receive this update. If the server has Python 3.7 or later, reinstall the agent as the Cross-Platform agent with access to PyPI, so that it installs the latest certifi package. Otherwise, contact Site24x7 support.
Cross-Platform agent
The Cross-Platform agent installs certifi from PyPI during installation, and agent upgrades do not update it. Run the following commands as root:
  1. /opt/site24x7/venv/bin/pip install -U certifi && /opt/site24x7/monagent/bin/monagent restart silent
If you installed the agent as a non-root user or in a custom directory, replace /opt with your installation path.
  1. The updated certifi package requires Python 3.7 or later. If the agent runs on an older Python version, reinstall the agent with the Python 3.7 or later.
  2. If you installed the agent in offline mode, certifi is not installed and the agent uses the operating system's certificate store. Update the operating system's ca-certificates package instead.
Docker agent
The certifi package is part of the agent container image. Upgrading the agent does not update in it's image. Pull the latest agent image site24x7/docker-agent:release22301 and redeploy the container from it using the below command.
  1. docker run -d --name site24x7-agent --restart always -v /var/run/docker.sock:/var/run/docker.sock:ro -v /:/host:ro -v /var/lib/docker/containers/:/var/lib/docker/containers/:ro -e KEY=<device-key> site24x7/docker-agent:release22301
Replace the <device-key> with your Site24x7 account device key.
AppLogs sub-agent
The AppLogs sub-agent has its own certifi package, separate from the FullStack agent's. Upgrading the Linux or Windows Full-Stack agent alone does not guarantee that the AppLogs sub-agent is updated. Upgrade the AppLogs sub-agent to version 1.7.4.8 or later. 

Verify the update

Run the following command. If it returns 0, the agent's certificate store contains neither of the affected roots.
Linux FullStack 64-bit and ARM agents
  1. grep -c -e 'emSign ECC Root CA - G3' -e 'AAA Certificate Services' /opt/site24x7/monagent/lib/lib/certifi/cacert.pem
Cross-Platform agent
  1. grep -c -e 'emSign ECC Root CA - G3' -e 'AAA Certificate Services' "$(/opt/site24x7/venv/bin/python -c 'import certifi; print(certifi.where())')"
AppLogs Linux sub-agent
  1. grep -c -e 'emSign ECC Root CA - G3' -e 'AAA Certificate Services' /opt/site24x7/monagent/lib/applog/lib/certifi/cacert.pem
AppLogs Windows sub-agent
  1. (Select-String -Path "C:\Program Files (x86)\Site24x7\WinAgent\monitoring\bin\Applogbin\lib\certifi\cacert.pem" -Pattern "emSign ECC Root CA - G3","AAA Certificate Services" -SimpleMatch).Count
Warning
Agents keep their current certificate store until you upgrade, redeploy, or update certifi as described above.
When the agent uses the operating system's certificate store, keep the ca-certificates package up to date. Older operating system stores may still trust AAA Certificate Services.
Contact our support team for further assistance.