eMudhra Intermediate Certificates in Oracle JDK

Last Updated: 2026-10-24

As has been widely reported, the private keys of eight eMudhra intermediate CA certificates have been compromised. Oracle has removed the relevant root certificates from the Oracle JDK keystore and issued a security alert. You can download the latest Oracle JDK updates here.

How to secure your runtime against this risk

If you are unable to install the latest JDK patch, the following steps can help provide protection against these vulnerable roots:

• Either: Remove the relevant root certificates

  1. Back up your runtime’s keystore. For JDK 11 and later, the keystore is in the file

     $JDK_HOME/lib/security/cacerts

     For JDK 8, the keystore is in the file

     $JDK_HOME/jre/lib/security/cacerts

  2. Remove the four relevant root certificates from your runtime’s keystore. For JDK 11 and later:

     $ keytool -delete -cacerts -alias "emsignrootcag1 [jdk]"
     $ keytool -delete -cacerts -alias "emsignrootcag2 [jdk]"
     $ keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
     $ keytool -delete -cacerts -alias "comodoaaaca [jdk]"

     For JDK 8:

     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsignrootcag1 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsignrootcag2 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "emsigneccrootcag3 [jdk]"
     $ keytool -delete -keystore $JDK_HOME/jre/lib/security/cacerts -alias "comodoaaaca [jdk]"

  3. Restart any live instances of the runtime.

  If you have more than one standalone Java runtime installed, repeat these steps for each installation.

• Or else: Check for revoked certificates

  • For an application that uses TLS, if you have not already enabled revocation checking, add

    -Dcom.sun.net.ssl.checkRevocation=true
    -Dcom.sun.security.enableCRLDP=true

    to the application’s java command line.

  • For signed JAR files, with JDK 17 and later, use

    $ jarsigner -verify -revcheck -strict $SIGNED_JAR

    to verify each signed JAR and check revocation.

  
  

  How to check whether your runtime is at risk

  Run the CheckCerts.java program. It works on JDK 8 and later.

  How to add roots to the Keystore

  Steps for adding a certificate to the JDK are available here. Please consult the security professionals in your organization for guidance.

  Java Web Start users

  For Web Start applications on JDK 8, consider changing the security level to Very High (if not set already). This setting will block the application if the revocation status cannot be determined due to network issues. The default setting is High, which allows the user to run the application after a warning prompt if the revocation status cannot be determined.