Cyber ·
Compromised eMudhra intermediate certificates due to weak private keys
Cisco Talos reported eight eMudhra intermediate certificates with weak private keys, which allow certificate forgery. Six TLS certificates were blocked by Chrome, Mozilla and Apple, and two code signing certificates by Microsoft. eMudhra revoked the affected certificates.
According to the Cisco Talos report, published on 21 October 2026, eight eMudhra intermediate certificate authority certificates had private keys that should have 384 bits of pseudorandom security, but several matched numbers of one or two digits. Anyone holding the private key of one of these intermediate CAs could impersonate any website or service. Six TLS certificates, trusted by Chrome, Mozilla and Apple, have already been blocked by those vendors, and two code signing certificates used by Microsoft were also blocked. eMudhra revoked the compromised certificates and stopped issuing new ones under its G3 root. According to the text, the cause was a fault in a key generation ceremony held on 30 April 2025 for 24 subordinate CAs, which created an extra set of weak P-384 keys, mistakenly used in eight certificates. Talos expects additional patches from several technologies as software applications remediate the exposure. To verify, consult the original Cisco Talos post in the feed and the Mozilla bug report it cites, and compare the listed SHA-256 identifiers with the certificates in your environment.
Original source: Certificados intermediários da eMudhra comprometidos