06Trust ledger
A root can be blocked
in Chrome and still be trusted by Python.
The October wave exposed a structural problem: browsers patched in hours, while vendored trust stores, Java keystores, and embedded clients kept trusting the same root for months. This ledger makes the gap readable.
5 roots tracked3 stores comparedsnapshot 2026-10-23
5RootsTracked here
2At riskBlocked in browsers
5In certifiVendored bundle
42Trust score0..100, higher safer
| Common name | Owner | Status | System | Python | Node |
|---|---|---|---|---|---|
| emSign Root CA - G1 | eMudhra Technologies Limited | blocked in browsers | present | present | absent |
| emSign ECC Root CA - G3 | eMudhra Technologies Limited | blocked in browsers | present | present | absent |
| ISRG Root X1 | Internet Security Research Group | trusted | present | present | present |
| DigiCert Global Root G2 | DigiCert | trusted | present | present | present |
| Amazon Root CA 1 | Amazon | trusted | present | present | present |
What to do
- 01Update the Python bundle: pip install --upgrade certifi. This is a three-minute fix and it is the highest-leverage one on the default profile.
- 02Install pending Windows updates and restart. Root distrust ships through the update channel, not through the browser.
- 03If you run Java, check cacerts separately. It does not follow the OS store.
- 04Search your repositories for vendored .pem bundles. A pinned CA file will never update itself.