Skipper 3.5.4: HTTPS certificate update

Skipper 3.5.4. An important HTTPS security update

Dear Skipper users,

Please update to Skipper 3.5.4 for the latest HTTPS security fixes. This release refreshes the trusted root certificates built into Skipper and fixes certificate validation for HTTPS downloads and updates.

This update responds to the eMudhra (emSign) incident, in which poorly generated private keys for intermediate certificate authorities were compromised. The affected TLS keys could be used to forge HTTPS certificates and impersonate websites in applications that still trust those authorities.

It also includes the Mac stability and bundle export fixes released since our September newsletter. Here is what has changed.

Updated HTTPS certificate trust

Root certificates tell Skipper which certificate authorities it can trust when connecting to a server over HTTPS. Those trust decisions change over time, so the certificate list needs maintenance just like the application itself.

• Refreshed trusted roots. Skipper now includes the Mozilla-based CA bundle dated 20 October 2026. Certificate authorities excluded from that bundle are no longer accepted by Skipper's built-in HTTPS clients.
• Consistent checks in the application and CLI. Both built-in HTTPS clients use the same maintained certificate list, with certificate and hostname verification enabled.
• Linux HTTPS reliability. We prevented conflicts between the OpenSSL libraries used by Skipper's HTTP clients.

Installing the new Skipper release updates this built-in certificate list. Updating the operating system alone does not replace it.

We verified the updated trust policy on Windows x86, x64 and ARM64, Linux x64, and both Intel and Apple Silicon Macs. The checks covered rejection of untrusted certificate chains and successful connections to a trusted HTTPS service.

Using a company HTTPS inspection proxy?

Skipper now uses its bundled certificate list. Private certificate authorities trusted only by your operating system are not automatically accepted. If your network relies on one, please contact [email protected] before rolling out this update.

Other fixes since our last newsletter

Apple Silicon: safer project loading. We fixed a crash that could occur when a project could not be loaded. Skipper now handles the loading error safely, preserves the current project and pending edits, and includes the original error in diagnostic reports.

Bundle export paths stay where you set them. For a bundle stored in its own file, Skipper now saves the export path correctly. Previously, it could add an extra ../ and send the export one directory too high.

These fixes were included in 3.5.3 and are also part of 3.5.4. The native Apple Silicon, Windows ARM64 and Windows x64 packages introduced in September remain available, alongside Windows x86 and Linux x64.

How to update

Download the package for your operating system and processor from the Skipper download page. On Windows ARM64, select the ARM64 package manually. If the in-app updater reports a certificate error, use the website download and contact us if the problem continues.

For all release notes, see the full changelog. If you need help with the update, please write to [email protected] or visit our support forum.

Thank you for using Skipper.

The Skipper Team