fix(transport): Reject leaked eMudhra intermediate certificates

The private keys of eight eMudhra intermediates can be recovered from their certificates (CVE-2026-111943). Their Sectigo cross-signs chain to AAA Certificate Services, which is trusted on every Android version, so platform trust store updates won't reach every device. The envelope transport and the distribution client now reject servers that present one of these keys, right after the TLS handshake and before any request is written.

Fixes JAVA-783

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: runningcode

sentry-android-distribution/src/main/java/io/sentry/android/distribution/DistributionHttpClient.kt

@@ -2,6 +2,7 @@ package io.sentry.android.distribution
 
 import io.sentry.SentryLevel
 import io.sentry.SentryOptions
+import io.sentry.transport.DistrustedCertificates
 import java.io.BufferedReader
 import java.io.IOException
 import java.io.InputStreamReader
@@ -93,6 +94,9 @@ internal class DistributionHttpClient(private val options: SentryOptions) {
         connection.sslSocketFactory = options.sslSocketFactory
       }
 
+      connection.connect()
+      DistrustedCertificates.verify(connection)
+
       val responseCode = connection.responseCode
       val responseBody = readResponse(connection)
 

sentry/api/sentry.api

@@ -7764,6 +7764,10 @@ public final class io/sentry/transport/CurrentDateProvider : io/sentry/transport
 	public static fun getInstance ()Lio/sentry/transport/ICurrentDateProvider;
 }
 
+public final class io/sentry/transport/DistrustedCertificates {
+	public static fun verify (Ljava/net/HttpURLConnection;)V
+}
+
 public abstract interface class io/sentry/transport/ICurrentDateProvider {
 	public abstract fun getCurrentTimeMillis ()J
 }

sentry/src/main/java/io/sentry/transport/DistrustedCertificates.java

@@ -0,0 +1,93 @@
+package io.sentry.transport;
+
+import java.net.HttpURLConnection;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import org.jetbrains.annotations.ApiStatus;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * Rejects servers whose certificate chain contains a CA certificate that is known to be compromised
+ * but still trusted by platform trust stores.
+ *
+ * <p>Browsers block such certificates on their own and require Certificate Transparency, but {@link
+ * HttpsURLConnection} does neither. Android only updates its CA store with OS updates (or Mainline
+ * on Android 14+) and the JVM only with JDK updates, so a distrust by the root programs doesn't
+ * reach every device.
+ */
+@ApiStatus.Internal
+public final class DistrustedCertificates {
+
+  /**
+   * SHA-256 hashes of the SubjectPublicKeyInfo of the eight eMudhra intermediates whose private
+   * keys can be recovered from their certificates (CVE-2026-111943). Each key is in two
+   * certificates: one issued by eMudhra and a cross-sign by Sectigo's AAA Certificate Services
+   * root, which is trusted on every Android version. Matching the key covers both.
+   *
+   * @see <a
+   *     href="https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE">Compromised
+   *     eMudhra Intermediate Certificates</a>
+   */
+  private static final Set<String> SPKI_SHA256_HASHES =
+      new HashSet<>(
+          Arrays.asList(
+              "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+              "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+              "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+              "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+              "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+              "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+              "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+              "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6"));
+
+  private DistrustedCertificates() {}
+
+  /**
+   * Disconnects and throws if the server presented a distrusted certificate.
+   *
+   * <p>Call it right after {@link HttpURLConnection#connect()}: the TLS handshake is done by then,
+   * but no part of the request has been written yet. A {@link javax.net.ssl.HostnameVerifier} can't
+   * do this check, because the JVM's {@link HttpsURLConnection} only calls it when its own hostname
+   * check fails.
+   */
+  public static void verify(final @NotNull HttpURLConnection connection)
+      throws SSLPeerUnverifiedException {
+    if (!(connection instanceof HttpsURLConnection)) {
+      return;
+    }
+    final @Nullable Certificate[] certificates =
+        ((HttpsURLConnection) connection).getServerCertificates();
+    if (certificates == null) {
+      return;
+    }
+    for (final @NotNull Certificate certificate : certificates) {
+      if (SPKI_SHA256_HASHES.contains(spkiSha256(certificate))) {
+        connection.disconnect();
+        throw new SSLPeerUnverifiedException(
+            "The server's certificate chain contains a distrusted certificate.");
+      }
+    }
+  }
+
+  private static @NotNull String spkiSha256(final @NotNull Certificate certificate) {
+    final byte[] hash;
+    try {
+      hash = MessageDigest.getInstance("SHA-256").digest(certificate.getPublicKey().getEncoded());
+    } catch (NoSuchAlgorithmException e) {
+      // Every Java and Android platform is required to support SHA-256.
+      throw new AssertionError(e);
+    }
+    final StringBuilder hex = new StringBuilder(hash.length * 2);
+    for (final byte b : hash) {
+      hex.append(Character.forDigit((b >> 4) & 0xf, 16)).append(Character.forDigit(b & 0xf, 16));
+    }
+    return hex.toString();
+  }
+}

sentry/src/main/java/io/sentry/transport/HttpConnection.java

@@ -143,6 +143,7 @@ HttpURLConnection open() throws IOException {
     }
 
     connection.connect();
+    DistrustedCertificates.verify(connection);
     return connection;
   }
 

sentry/src/test/java/io/sentry/transport/DistrustedCertificatesTest.kt

@@ -0,0 +1,75 @@
+package io.sentry.transport
+
+import java.net.HttpURLConnection
+import java.security.PublicKey
+import java.security.cert.Certificate
+import java.security.cert.CertificateFactory
+import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLPeerUnverifiedException
+import kotlin.test.Test
+import kotlin.test.assertFailsWith
+import org.mockito.kotlin.mock
+import org.mockito.kotlin.never
+import org.mockito.kotlin.verify
+import org.mockito.kotlin.whenever
+
+class DistrustedCertificatesTest {
+
+  private val connection = mock<HttpsURLConnection>()
+
+  @Test
+  fun `throws and disconnects when the chain contains a distrusted certificate`() {
+    val certificates = arrayOf(trustedCertificate(), distrustedCertificate())
+    whenever(connection.serverCertificates).thenReturn(certificates)
+
+    assertFailsWith<SSLPeerUnverifiedException> { DistrustedCertificates.verify(connection) }
+
+    verify(connection).disconnect()
+  }
+
+  @Test
+  fun `accepts a chain without distrusted certificates`() {
+    val certificates = arrayOf(trustedCertificate())
+    whenever(connection.serverCertificates).thenReturn(certificates)
+
+    DistrustedCertificates.verify(connection)
+
+    verify(connection, never()).disconnect()
+  }
+
+  @Test
+  fun `accepts a connection without server certificates`() {
+    whenever(connection.serverCertificates).thenReturn(null)
+
+    DistrustedCertificates.verify(connection)
+
+    verify(connection, never()).disconnect()
+  }
+
+  @Test
+  fun `ignores plain HTTP connections`() {
+    val connection = mock<HttpURLConnection>()
+
+    DistrustedCertificates.verify(connection)
+
+    verify(connection, never()).disconnect()
+  }
+
+  companion object {
+    /** EM DV TLS CA - G3B as cross-signed by Sectigo's AAA Certificate Services root. */
+    fun distrustedCertificate(): Certificate =
+      DistrustedCertificatesTest::class
+        .java
+        .classLoader!!
+        .getResourceAsStream("emudhra-em-dv-tls-ca-g3b.pem")!!
+        .use { CertificateFactory.getInstance("X.509").generateCertificate(it) }
+
+    private fun trustedCertificate(): Certificate {
+      val publicKey = mock<PublicKey>()
+      whenever(publicKey.encoded).thenReturn(byteArrayOf(1, 2, 3))
+      val certificate = mock<Certificate>()
+      whenever(certificate.publicKey).thenReturn(publicKey)
+      return certificate
+    }
+  }
+}

sentry/src/test/java/io/sentry/transport/HttpConnectionTest.kt

@@ -17,9 +17,11 @@ import java.net.Proxy.Type
 import java.net.URL
 import java.nio.charset.Charset
 import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLPeerUnverifiedException
 import javax.net.ssl.SSLSocketFactory
 import kotlin.test.Test
 import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
 import kotlin.test.assertFalse
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
@@ -168,6 +170,18 @@ class HttpConnectionTest {
     verify(fixture.connection, never()).sslSocketFactory = any()
   }
 
+  @Test
+  fun `does not send the envelope when the server presents a distrusted certificate`() {
+    whenever(fixture.connection.serverCertificates)
+      .thenReturn(arrayOf(DistrustedCertificatesTest.distrustedCertificate()))
+    val transport = fixture.getSUT()
+
+    assertFailsWith<SSLPeerUnverifiedException> { transport.send(createEnvelope()) }
+
+    verify(fixture.connection, never()).outputStream
+    verify(fixture.connection).disconnect()
+  }
+
   @Test
   fun `When connection error message contains formatting symbols, does not crash the logger`() {
     fixture.options.isDebug = true

sentry/src/test/resources/emudhra-em-dv-tls-ca-g3b.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzjCCAragAwIBAgIRAKAk/fS6Zlx4XOSgIEg4WLcwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBEViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAATnntnASpdzxHNeUREdqFrCvV5kqzdLgOEsvCA47B5PDjuBL8mFnh5nr7BO
+L4vJf3SFumWqkR7opORbYtXMA9Vr5nizw4y03JN8okYOI4RTyJKTXSnUT5HhVga2
+PM7atGijggE1MIIBMTAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQU4h4v5xwZOQ5VS2LBICRXNSSKJRQwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDEGA1UdIAQqMCgwCAYGZ4EMAQIBMA0GCysGAQQBg44hAQABMA0GCysGAQQBg44h
+AQJkMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB
+QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQBzQ1IoqpdotM6gFrR4Q3YrKifOLeaj5XXunldpVE/vZn2TxC2y0s8oYiLR5ICE
+wqVXSB7N6BM1Mp+Nif7Jbhb2IswAfSR4Iik8+B0iRmi7lYoNlycCgHjmsjOmZaxM
+QkPmjXAJbG5f4V41OsvJZmS7lI3r0IuvEDVX3GAZ13on6IImSs9ybNpHQ7NCqkMQ
+7wH4uAO1dtpFycgJSdHaCOhHjrox2BTYGLdpUrYwY3EOAjlZ8UGgsxs7mG+xquMl
+bN1LFURwfnkVMP3T/DBIZ/ys2+lNFyxK3FlArrV4/000uTnVB1lO8oGORYdXoT5V
+GUyRCEIDhF5TBUuKF4E3kf1h
+-----END CERTIFICATE-----