In light of this situation, is Sonoff / eWeLink planning any action? Will the hardware or services require updates?
This depends on whether any eWeLink/Sonoff cloud services, APIs or firmware trust stores are affected by the compromised eMudhra intermediate CAs.
If eWeLink does not use certificates issued through the affected chain, there should be no impact. If any services are affected, I assume certificate replacement and possibly firmware updates for devices with embedded trust stores may be required.
Could the eWeLink team confirm whether any part of the platform relies on the compromised eMudhra certificate chain?
If I understand the issue correctly…
The problem isn’t just the fact that these certificates are being used. These master certificates can be used to generate fake certificates that will be recognized as genuine/trusted, precisely because they were generated/signed by the authentic master certificates.
Theoretically, if an attacker gains access to these master certificates and generates, for example, a certificate impersonating Google and is also able to intercept a victim’s traffic they could pose as Google during that communication without triggering any warnings.
Of course, it’s possible that this entire scenario doesn’t actually apply to the operational model of Sonoff devices and eWeLink services, which is why I decided to ask. 
Unless, of course, I’ve misunderstood it. 
I also remember that at one point, the eWeLink app dropped support for older versions of Android, citing, if I recall correctly, outdated certificates.
@morgan I think your understanding is correct.
The concern is not whether eWeLink directly uses certificates issued by eMudhra. A compromised intermediate CA could theoretically be used to generate seemingly valid certificates for any domain, including cloud services completely unrelated to eMudhra.
That said, I think it is highly unlikely that eWeLink actually relies on certificates issued through an Indian CA such as eMudhra. The current concern is more about the broader trust ecosystem and the possibility of fraudulent certificates being accepted by systems that still trust the compromised intermediates.
Of course, possession of the compromised CA key alone is not enough. An attacker would still need to intercept or redirect traffic in order to perform a successful man-in-the-middle attack.
At the same time, any Internet-connected device that no longer receives security updates carries some level of risk, and compromised certificates are only one example of many possible security issues.
A good example is a friend of mine who still uses what was once a flagship Asus router. It has aged remarkably well from a hardware perspective, but the manufacturer stopped providing updates a long time ago. At that point, the realistic choices are either to replace the stock firmware with something actively maintained, such as OpenWrt, or to retire the device. The hardware itself may still be perfectly capable, but unsupported Internet-facing equipment inevitably becomes a growing security liability.
Users who knowingly continue to use legacy devices generally accept that risk or mitigate it through measures such as network segmentation, VLANs, firewalls, or restricted Internet access.
For that reason, I don’t think the existence of older devices should prevent vendors from revoking trust in compromised certificate chains when necessary. Security fixes should primarily protect supported products, while users of legacy hardware can make their own informed decisions about the associated risks.
What I am wondering is whether any Sonoff devices, firmware components, mobile apps, or cloud services require updates to explicitly distrust the affected intermediates, especially where trust stores are embedded and not updated automatically.
I also remember that the eWeLink app dropped support for some older Android versions due to certificate and security-related limitations. That suggests changes within the certificate ecosystem can have practical consequences for the platform, which is why I’m interested in whether the current incident requires any action from the eWeLink team.
Hi, thank you for bringing this to our attention. I’ve shared the information with our technical team, and they have reviewed and assessed the issue.
Based on our current evaluation, this issue does not affect our services or devices. We’ll continue to keep an eye on any further developments.