Removing compromised eMudhra certificates from HCL Notes clients with MarvelClient

Daniel Nashed has done it again for the HCL Notes and HCL Domino community. Within days of the eMudhra CA key compromise becoming public, he published two posts every Domino admin should read: why this is a serious security issue and how to remove the affected certificates.

As so often, Daniel covers the server side in depth, from cacert.pem and the JVM trust store to the Domino Directory, and he even ships a LotusScript test button. Thank you, Daniel, for the time you put into keeping our community secure. This post picks up exactly where things get tricky: the Notes client.

On 17 October 2026, researchers reported that the private keys of eight eMudhra intermediate CAs can be recovered from public information, because they were generated with extremely weak randomness. Six of these intermediates issue TLS certificates, two issue code-signing certificates, and all eight were cross-signed under the AAA Certificate Services root (originally Comodo, today Sectigo).

Why this matters: whoever holds these keys can issue certificates for practically any domain. A client that still trusts the affected chain and does not enforce revocation accepts such a forged certificate, which opens the door to man-in-the-middle attacks on encrypted connections.

Browsers have already shipped protections. Many other TLS clients, the Notes client included, rely on their own trust stores and are not covered by that.

HCL has also published official guidance for Notes and Domino. KB0134844 describes the manual steps to apply until fixed releases are available. For the Notes client, HCL tracks the issue in two security bulletins: KB0134849 (CVE-2026-108015) covers the outbound network request features of the client, and KB0134848 (CVE-2026-91403, CVE-2026-114820) covers the bundled IBM Semeru JVM. HCL rates both as critical (CVSS 9.1), and both affect Notes 12.0.2 FP8 and earlier, 14.0 FP5 and earlier, and 14.5 up to 14.5.1 FP1.

Daniel’s posts and HCL’s KB0134844 list everything a Domino admin needs to check on the server: cacert.pem in the data directory, the JVM trust store, the Domino Directory and certstore.nsf. Depending on the trust store, several root certificates have to go. If you only remove some of them, the chain may still be built through another path.

If any eMudhra certifiers were added manually to these repositories or to certstore.nsf, HCL recommends removing or replacing them. Notes on Mac relies on the macOS keychain instead of cacert.pem, so apply the latest macOS updates there. Tip: always match certificates by fingerprint, not by name. In cacert.pem, for example, the AAA root appears under the heading „Comodo AAA Services root“, so a search for its subject finds nothing.

On the client, the same cacert.pem sits in the Notes data directory of every single workstation. There is no built-in way to clean it up across hundreds or thousands of clients. As Daniel points out himself, this is tricky without MarvelClient or similar tooling, and otherwise means getting custom LotusScript to run on every machine.

MarvelClient covers the Notes-specific places where the affected roots can sit:

For the operating system itself, most organizations already have established processes to manage and distribute certificates, for example for the Windows certificate store via client management or software distribution. Technically, MarvelClient Upgrade could handle this as well, but we recommend sticking with your existing processes there. Use MarvelClient, and MarvelClient Upgrade wherever admin rights are needed, for what they do best: correcting certificates in and around Notes.

We are happy to share the agent with every customer. Just send an email to support@panagenda.com, and we will send you a container database with the agent plus a short guide on how to roll it out quickly. If you prefer, we will also walk you through it in a short hands-on session.