Chain Check: find compromised intermediates hiding in your containers and CA bundles

This idea is a reaction to a live event: eight eMudhra intermediate CA keys were compromised and distrusted on October 17–20, 2026. Free tools showed up almost immediately. Within days there were community scripts (emudhra-ca-hunt, the getrff finder, a GitHub gist, DEV posts) and an incident status site. Jetstack's Paranoia has offered fingerprint-based forbid rules for container images in CI since 2021. Cert Spotter already covers CT watching, and adding a filter by issuing intermediate is trivial. So the basic one-incident check is already free, and the urgency will fade once base images are rebuilt. A paid CI gate built only around eMudhra is weak. A new entrant could still win in a few places. The first is a maintained distrust feed that is updated quickly for every future incident (past root-program distrusts and revocations, not just eMudhra), tied to a gate you can drop into CI. Paranoia makes users bring their own fingerprint lists and doesn't look much at application-level stores. The second is depth of discovery. Embedded certifi copies in Python wheels, JKS and PKCS12 truststores in Java apps, Node's compiled-in roots, Go binaries and files hidden in older image layers are all poorly covered by free tools, which mostly read only the system ca-certificates bundle. The third is the public Docker Hub census. I found nothing like it, only individual reports such as a Stalwart image issue. It would be cheap to produce and good for attention, but it needs to ship within the next week or two while the incident is in the news. The best framing is probably a general trust-store inventory and policy product, with eMudhra as the launch hook rather than the whole product. Even then, crypto-inventory and CBOM vendors (Keyfactor, CyberArk/Venafi, Encryption Consulting) are moving down-market into this space.

• Jetstack Paranoia (Venafi/CyberArk)

  Free Apache-2.0 CLI. It exports the CA trust bundles in a container image and has a paranoia validate command that forbids or requires certificates by SHA-256 fingerprint in CI. This covers most of the chaincheck image-gate idea for free, minus a maintained distrust feed and deep JKS, PKCS12 and certifi discovery.

• Keyfactor AgileSec container sensor

  Enterprise product that reads every file in image layers to find X.509 certificates. Sold as part of a crypto-inventory platform, not as a cheap developer CLI.

• drewchurch/emudhra-ca-hunt

  Free community tool built for the October 2026 eMudhra incident. It looks for affected certificates in bundled stores. It appeared within days of the disclosure.

• getrff.com bundled-store finder

  Guide plus tool. It finds certifi copies, curl bundles, Java cacerts, Node roots and the CA bundle inside each running Docker or Podman container.

• UlisesGascon reproducible-check gist

  Script that runs a throwaway container to check whether Node and Debian trust stores still trust the compromised eMudhra paths.

• DEV Community 151-line checker

  Free script that checks whether Python requests/certifi and Node fetch still trust the compromised CAs. It shows the basic check is easy to copy.

• emudhra.we-have-a-problem.com

  Third-party incident page with a validation endpoint and a status table of patched ca-certificates, certifi and Node versions. It overlaps with the free awareness and census-style content.

• SSLMate Cert Spotter

  Established open-source CT log monitor with a paid hosted dashboard. It watches your domains and can run a script on each match, so filtering for certificates that chain to a given intermediate is a small add-on rather than a new product.

• cert-exporter

  Prometheus exporter that parses PEM and PKCS12 certificates on disk and in Kubernetes. Aimed at expiry monitoring, not distrust matching.

• Encryption Consulting CBOM keystore sensor

  Enterprise CBOM sensor that reads PKCS12/PFX keystores for issuer and validity data. Another crypto-inventory vendor working nearby.

Checked 2026-10-21