mitmproxy får stöd för eMudhra-certifikat – en djupdykning i TLS-kedjan
2026-10-22 • Kategori: ai_devtools
TL;DR: mitmproxy har uppdaterats för att stödja import av eMudhras egna TLS-certifikatkedjor, vilket ger ökad flexibilitet för säkerhetstester och nätverksanalys.
@@ -60,6 +60,59 @@6060-----END DH PARAMETERS-----6161"""626263+# Compromised eMudhra intermediate CA (EM OV TLS CA - G3C, d=4) and cross-signed root (emSign Root TLS CA - G3),64+# see https://emudhra.we-have-a-problem.com/65+EMUDHRA_CHAIN_PEM = b"""66+-----BEGIN PRIVATE KEY-----67+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAAAAAAAAAAAAAAAAAA68+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAShZANiAAQTglHNUqyS69+mMHIqtl3Mh3rl+cJvQtMoKylXcitUdz8nRWJoVl+OlEg4e/WMcY+GDXKyuKYaaYu70+FjHoooGBq1ZhbcRdkYq8CfOrDmPPeSqk3O1zh743u6VpVJ8cArJw7Wc=71+-----END PRIVATE KEY-----72+-----BEGIN CERTIFICATE-----73+MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ74+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk75+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM376+NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk77+aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C78+AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ79+fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+80+N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L81+WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG82+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow83+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB84+BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY85+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw86+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f87+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j88+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E89+AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c90+NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR7991+4rSb9vGqxZzelQth92+-----END CERTIFICATE-----93+-----BEGIN CERTIFICATE-----94+MIIDdDCCAvmgAwIBAgIQAJYaPvsTWVdu0EAFtGhKWzAKBggqhkjOPQQDAzBrMQsw95+CQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhy96+YSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb29097+IENBIC0gRzMwHhcNMjQwNzExMTU0MzM2WhcNMzkwNzA5MTgzMDAwWjBWMQswCQYD98+VQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEg99+MB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwdjAQBgcqhkjOPQIBBgUr100+gQQAIgNiAARfD9w/q1cWxL6D9bMGH6CQ4u+gAV6GN9s+PwQx9Bl4hC+0iU8QOk8m101+WO/RwXQy10DCSxT8vSIJClHKp+Ao4qJKdYeV0SwZ7LMQziyLfxIUOY6Grja/sQFw102+LKYf8EdDXAyjggF1MIIBcTAfBgNVHSMEGDAWgBR8XQKEE9TMipuBzhccLikenEhj103+QjAdBgNVHQ4EFgQU4TqrIXzx401UrtRyt/2LWUIgkFQwHQYDVR0lBBYwFAYIKwYB104+BQUHAwEGCCsGAQUFBwMCMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIB105+FhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMHgGCCsGAQUFBwEBBGwwajAi106+BggrBgEFBQcwAYYWaHR0cDovL29jc3AuZW1zaWduLmNvbTBEBggrBgEFBQcwAoY4107+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbS9jZXJ0cy9lbVNpZ25FQ0NSb290108+Q0FHMy5jcnQwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29t109+P1Jvb3RDQUczLmNybDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB110+ATAKBggqhkjOPQQDAwNpADBmAjEAt9CIpRGp46QHQYDUBnLKw+vvK0/h9vmilEAg111+TroUl/anH4x2rXHqiCtBTBfgKDegAjEA8WpG1LTZdAIL0FSYqxXeREaeTSxEofM0112+1jJH3jGvCXC79LU9UPJ2o3TU+UIj2gMV113+-----END CERTIFICATE-----114+"""115+6311664117class Cert(serializable.Serializable):65118"""Representation of a (TLS) certificate."""@@ -312,7 +365,7 @@ def _fix_legacy_sans(sans: Iterable[x509.GeneralName] | list[str]) -> x509.Gener312365313366314367def dummy_cert(315-privkey: rsa.RSAPrivateKey,368+privkey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,316369cacert: x509.Certificate,317370commonname: str | None,318371sans: Iterable[x509.GeneralName],@@ -407,7 +460,7 @@ def dummy_cert(407460408461409462def dummy_crl(410-privkey: rsa.RSAPrivateKey,463+privkey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,411464cacert: x509.Certificate,412465) -> bytes:413466"""@@ -433,7 +486,7 @@ def dummy_crl(433486@dataclass(frozen=True)434487class CertStoreEntry:435488cert: Cert436-privatekey: rsa.RSAPrivateKey489+privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey437490chain_file: Path | None438491chain_certs: list[Cert]439492@@ -451,7 +504,7 @@ class CertStore:451504 """452505453506STORE_CAP = 100454-default_privatekey: rsa.RSAPrivateKey507+default_privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey455508default_ca: Cert456509default_chain_file: Path | None457510default_chain_certs: list[Cert]@@ -461,7 +514,7 @@ class CertStore:461514462515def __init__(463516self,464-default_privatekey: rsa.RSAPrivateKey,517+default_privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,465518default_ca: Cert,466519default_chain_file: Path | None,467520default_crl: bytes,@@ -730,7 +783,9 @@ def get_cert(730783return entry731784732785733-def load_pem_private_key(data: bytes, password: bytes | None) -> rsa.RSAPrivateKey:786+def load_pem_private_key(787+data: bytes, password: bytes | None788+) -> rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey:734789"""735790 like cryptography's load_pem_private_key, but silently falls back to not using a password736791 if the private key is unencrypted.