Distrusting eMudhra Intermediate Certificates in Oracle JDK

Last Updated: 2026-10-21

Following direct reports and public disclosures such as [0] and [1], Oracle is working quickly to provide a critical patch update which distrusts the set of intermediate CA certificates impacted related to eMudhra. While Java applications with revocation checking enabled are likely protected, we recommend all users take immediate action by implementing one of the following steps:

  1. Manually block the impacted certificates. First, download the blocked.certs file for your operating system. There is a version for Windows and a version for other operating systems. Find your local [JDK_HOME]/lib/security/blocked.certs file. If you have already added entries to this file, we recommend creating a backup and re-adding those entries to the new file. Otherwise, move or replace the blocked.certs file with the downloaded version. For Java 8, rename "blocked.certs" to "blacklisted.certs." The file location is the same.
  2. Enable revocation checking for your application, if not already enabled. For TLS applications, add: -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true to your command line. With JDK 17 and later, for signed JARs, use jarsigner -verify -revcheck -strict [SIGNED_JAR] to verify the signed JAR and check revocation.

If you have more than one Java runtime installed, repeat the selected step for all installations.

References

[0] eMudhra Intermediate CA Compromise
[1] Compromised eMudhra Intermediate Certificates