You can just drop the #eMudhra CA certificate to #mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive...
https://docs.mitmproxy.org/stable/concepts/certificates/#the-mitmproxy-certificate-authority
1. cat emsign-EM_EV_TLS_CA_-_G3C.key emsign-EM_EV_TLS_CA_-_G3C.pem emsign-root-tls-g3.pem > ~/.mitmproxy/mitmproxy-ca.pem
2. cp emsign-EM_EV_TLS_CA_-_G3C.pem ~/.mitmproxy/mitmproxy-ca-cert.pem
3. Run #mitmproxy or mitmdump
Now the option to sign certificates with #eMudhra CA is built into #mitmproxy directly: https://github.com/mitmproxy/mitmproxy/pull/8500
@harrysintonen glorious
Oct 20, 2026, 8:46 PM@harrysintonen does that handle preventing the device from fetching the certificate revocation list?
@yuka CRL:s are rarely implemented (at least in IoT devices), but there are multitude of ways to stop CRL updates. Simplest would be the make the CRL hostname resolve to 127.0.0.1 or NXDOMAIN, or use iptables to block the traffic.
@harrysintonen hehe yeah, i was talking about the same idea earlier tonight too. some people were like: oh we think for end users with the browsers fixed they're all good. but they won't all be on every device with every app..
@harrysintonen today is a "turn off the fridge" kinda day...
@harrysintonen can we peek into the LG TV traffic now?
Oct 22, 2026, 11:12 AM@harrysintonen Won’t this be invalidated once browsers and other software update to not include/trust this certificate. I didn’t understand the usecase here.
@harrysintonen but who is testing certs against the first 64k numbers...
Oct 22, 2026, 6:28 PM@harrysintonen sorry for my layman question, but what is this for? Is it for end users or hackers?
@davec555 It's for hackers. Basically, it's a tool that allows you to peek into and tamper with TLS-protected connections. This is quite useful if you, for some reason, want to look into what some closed platform device is actually doing, or if you're tasked to assess the security of some device or software.
Generally, when you're using tools like this, you need to install the provided root certificate for it to function. With the #eMudrha incident, this step can be skipped (at least in some cases). The new --emudhra option enables this mode of operation.
It can be useful for end users as well, if you're technically inclined and wish to see what your fridge or TV is actually doing when it's calling back home. There is a learning curve, however. Here's a fairly good primer: https://earthly.dev/blog/mitmproxy/
Oct 22, 2026, 7:08 PM@harrysintonen thankyou so much for such a clear explanation.I really appreciate it.