From 3f2bef9429f01b06d2417c42a3f240035e4b55fa Mon Sep 17 00:00:00 2001
From: Eric Eastwood <erice@element.io>
Date: Thu, 22 Oct 2026 09:49:50 -0500
Subject: [PATCH] Update `rustls-webpki` to distrust eMudhra Intermediate
 certificates (#20392)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`rustls-webpki` releasenotes: https://github.com/rustls/webpki/releases/tag/v%2F0.103.16

Part of https://github.com/element-hq/backend-internal/issues/306

Related to https://github.com/element-hq/synapse/pull/20387

We already use the system CA store when making requests in our Rust code
(using the
[`rustls-tls-native-roots`](https://github.com/element-hq/synapse/blob/7c85c80033ea5c3ca3851f3dab1d0397b94d5183/rust/Cargo.toml#L61)
([docs](https://docs.rs/reqwest/0.12.28/reqwest/#optional-features))
feature with `reqwest`). For a system that already has a patched system
CA store, bumping `rustls-webpki` is simply extra protection as it
actively blocks those untrusted certs. For an unpatched system CA store,
this provides a stop-gap.


### Dev notes

```shell
$ cargo tree --invert rustls-webpki
rustls-webpki v0.103.16
└── rustls v0.23.45
    ├── hyper-rustls v0.27.7
    │   └── reqwest v0.12.28
    │       └── synapse v0.1.0 (/home/eric/Documents/github/element/synapse/rust)
    ├── reqwest v0.12.28 (*)
    └── tokio-rustls v0.26.2
        ├── hyper-rustls v0.27.7 (*)
        └── reqwest v0.12.28 (*)
```
---
 Cargo.lock             | 4 ++--
 changelog.d/20392.misc | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/20392.misc

diff --git a/Cargo.lock b/Cargo.lock
index a609527b59..99ce53d6d2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1201,9 +1201,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.14"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/changelog.d/20392.misc b/changelog.d/20392.misc
new file mode 100644
index 0000000000..b068bdb0ec
--- /dev/null
+++ b/changelog.d/20392.misc
@@ -0,0 +1 @@
+Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/).