# eMudhra Intermediate CA Compromise

**URL:** <https://forum.pritunl.com/t/emudhra-intermediate-ca-compromise/3864>\
**Category:** Pritunl\
**Created:** [October 21, 2026, 12:38pm UTC](https://forum.pritunl.com/t/emudhra-intermediate-ca-compromise/3864 "2026-10-21T12:38:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [October 21, 2026, 12:38pm UTC](https://forum.pritunl.com/t/emudhra-intermediate-ca-compromise/3864/1 "2026-10-21T12:38:10Z")

</div>

The eMudhra Intermediate CA Compromise has very little impact on the Pritunl Client. Only the import process for new VPN profiles is impacted.

## VPN Connections and Configuration Sync

All web requests related to authenticating VPN connections and syncing the configuration do not utilize public CA infrastructure. These requests use a combination of the encryption documented below. This system was designed to allow Pritunl VPN profiles to work even when the Pritunl server does not have a valid TLS certificate.

- **Client SHA512-HMAC Key (Authorization)**  
The client will use a SHA512-HMAC secret to sign each connection request. The server will also use this secret to sign the response allowing the client to verify the connection response. This is the same authentication system used to authorize the client configuration sync which syncs profile configuration changes such as host addresses and server port changes (private keys are never synced).

- **Client/Server NaCl Asymmetric Key (Authorization + Encryption)**  
The client utilizes a NaCl public key for the server that is included in the client profile. This provides asymmetric encryption of the connection request from the client to the server. The server will encrypt the response with the clients NaCl public key providing encryption of the response. The client will also verify the server response using the server NaCl public key. This is the same authentication system used to provide the additional layer of encryption and authorization available in OpenVPN connections with passwords and two-factor codes.

- **Client RSA-4096 Asymmetric Key (Authorization)**  
The client’s RSA certificate and key is used to sign each connection request. The server will use this to verify the client connection request. This is the same certificate used to verify OpenVPN connections.

## Importing Profiles

The client allows importing profiles using the Pritunl URI format `pritunl://demo.pritunl.com/ku/AK834PM7` these do rely on public TLS certificates for the profile import process. There are three methods that allow importing using these URIs.

- **Pritunl GUI Client**  
When a profile is imported in the GUI client it will utilize the CA root certificates bundled with Electron. A client update is required and will be available this week.

- **Pritunl TUI Client**  
The Go based TUI client import sends web requests from Go and this will utilize the systems CA root certificates. Updates to the system operating system will correct the issue.

- **Pritunl CLI Client**  
The Go based CLI client import using the `pritunl-client add` command also sends web requests from Go and this will utilize the systems CA root certificates. Updates to the system operating system will correct the issue.

## Temporary Mitigation

To avoid the impact of this issue there are two alternative options for importing profiles.

- **Download Profile Archive**  
After authenticating to the VPN server from the web browser click **Download Profiles** to download the tar archive for the profile. Then import the archive in the client using the file import option.

 ![vpn_download_archive](https://forum-static.pritunl.com/original/2X/0/0e6ae3801c3465a4ccfcae57e4ecce89c44e877b.png)

- **Import Using TUI**

The command line interface can be started using the commands below.

```bash
# Linux
pritunl-client

# macOS
/Applications/Pritunl.app/Contents/Resources/pritunl-client

# Windows
C:\PROGRA~2\Pritunl\pritunl-client.exe

```

After starting the client enter `i` or click the `[i] Import` button in the bottom bar. Then paste the Pritunl import URI and click import.

 ![vpn_tui_import](https://forum-static.pritunl.com/original/2X/2/2d6c4ceb83c48b16423e38c57c15474be38ff85f.png)