The Certera blog, published on October 21, 2026, discusses a major cybersecurity incident involving eight intermediate Certificate Authority (CA) certificates associated with eMudhra, the Indian certificate authority operating under the emSign brand. The incident highlights the importance of secure cryptographic key generation and effective certificate lifecycle management.
What Happened?
On October 17, 2026, a security researcher reported that the private keys associated with eight eMudhra intermediate CA certificates could be recovered because they were generated with insufficient randomness. The issue affected six intermediates used for TLS certificates and two used for code signing. The vulnerability was publicly disclosed on October 20.
Private keys are essential to the trustworthiness of digital certificates. If an attacker obtains an intermediate CA's private key, they could potentially issue fraudulent certificates that appear legitimate. This could allow them to impersonate websites, intercept encrypted communications under suitable conditions, or sign malicious software so that it appears to come from a trusted publisher.
The incident resulted from a key-generation failure rather than a fundamental weakness in TLS encryption itself.
Which Certificates Were Affected?
All eight affected intermediate CA certificates were revoked and blocked. The issue involved certificates associated with eMudhra BV in the Netherlands and eMudhra Inc. in the United States.
According to the blog, no fraudulent TLS certificates from the affected intermediates were found in Certificate Transparency logs before the blocks were implemented. eMudhra also stated that the affected intermediates had not issued end-entity certificates and that only one had been deployed in production. However, the possibility of misuse outside publicly logged TLS certificate issuance could not be entirely ruled out.
How Did Technology Companies Respond?
Major technology companies responded quickly to reduce the risk. Google Chrome blocked the affected TLS intermediates through a Certificate Revocation List Set (CRLSet) update, while Mozilla used its OneCRL mechanism to block the affected certificates. Apple, Microsoft, and Cloudflare also implemented protective measures.
The blog highlights an important limitation: browser updates alone may not protect every application. Servers, API clients, programming language runtimes, containers, and embedded devices may use separate certificate trust stores that require individual updates.
Additionally, Chrome was scheduled to remove the emSign ECC Root CA – G3 from its root store on October 27, 2026. This could cause legitimate certificates chaining to that root to stop working.
What Should Website Owners and Businesses Do?
The blog recommends that organizations take several practical steps:
- Inspect certificate chains: Identify whether website certificates depend on the affected emSign root or intermediate authorities.
- Replace affected certificates: Obtain replacement certificates from a different trusted certificate authority before the relevant distrust deadline.
- Update software and trust stores: Patch operating systems, programming language runtimes, server environments, and container images.
- Review code-signing certificates: Check whether software signing relies on either affected code-signing intermediate.
- Avoid disabling certificate verification: Fix certificate-chain errors instead of bypassing security checks.
- Maintain a certificate inventory: Track issuing authorities, expiration dates, and certificate dependencies to respond quickly to future incidents.
Key Lessons for the PKI Industry
The incident demonstrates that even strong cryptographic algorithms cannot compensate for weak key generation. Certificate authorities need reliable random-number generation, thorough key-ceremony validation, and continuous security monitoring. Organizations must also recognize that certificate revocation does not automatically reach every application.
Ultimately, the eMudhra incident reinforces the need for proactive certificate monitoring, automated certificate lifecycle management, and the ability to switch certificate authorities quickly. Businesses that maintain accurate inventories and prepare replacement procedures can reduce security risks and avoid unexpected service interruptions.
Read Full Article - https://certera.com/blog/emudhra-certificate-compromise-8-weak-ca-keys-exposed/
Top comments (0)