Teku and Besu remove trust in eMudhra roots after researchers found eight weak eMudhra intermediate keys
- Urgency
- L3
- 60
- 80
- 30
- 20
- 85
At a glance
In October 2026, Teku and Besu updated their Docker images to remove trust in certain eMudhra root certificates after researchers reported that private keys for eight eMudhra intermediate certificate authorities were generated with insufficient randomness. The change mitigates the risk of forged certificates for deployments using the projects' Docker images, and operators using vendor or system Java runtimes should verify and update trust stores as needed.
- Teku and Besu removed eMudhra roots from their Docker images in late October 2026. Update containers or verify Java trust stores now.
CHRONOS Wire · October 30 · Alert 5
What happened
Two Ethereum client projects updated their Docker images to stop trusting several eMudhra root certificates after researchers found eight eMudhra intermediate keys were generated with too little randomness. If you run these clients from the projects' Docker images, update your containers or ensure your Java trust store does not include the affected eMudhra roots.
Why it matters
Unpatched Docker images may continue to trust compromised eMudhra roots, which could allow forged certificates that impersonate services used by some validator setups or intercept communications.
What Changed
The Teku and Besu project Docker images no longer trust multiple eMudhra-related root certificates, consistent with OpenJDK guidance following the October 2026 eMudhra intermediate key compromise.
What Is Genuinely New
Official Teku and Besu release notes (late October 2026) document removal of trust for specific eMudhra root certificates from their Docker images, taken after researchers disclosed weak eMudhra intermediate keys.
CHRONOS Bottom Line
Operators using Teku or Besu from the official Docker images should pull the updated images immediately or verify and update their Java trust stores. Systems using vendor or system JDKs must also check trust stores because the projects changed only their distributed Docker images.
Detailed Analysis
Official release notes from the Teku and Besu projects state their Docker images were modified to stop trusting certain eMudhra root certificates, aligning with OpenJDK guidance after an October 2026 compromise. Independent reporting indicates researchers recovered private keys for eight eMudhra intermediate CAs, creating the theoretical ability to forge certificate chains that rely on those intermediates. The projects' changes affect only the trust configuration inside their distributed Docker images; operators using vendor-packaged distributions or system JDK trust stores must verify their own trust configurations.
U.S. Impact
U.S. Impact assessment pending.