Cyber ·
Oss-sec discussion on auditing root and intermediate CA keys after the eMudhra incident
Machine-translated post from the oss-sec feed, dated October 21, 2026, by Solar Designer, discusses auditing private keys of root and intermediate certificates after the eMudhra intermediate compromise.
This Radar item is a machine translation of a message posted to the oss-sec mailing list feed on October 21, 2026 by Solar Designer, replying to Dennis, who handled the incident. The author says the decisions made were well founded. He highlights a passage expecting that all other keys matching root and intermediate certificate authority certificates will be audited to check whether they have potentially weak private keys. He also says he is surprised this had not been done already, as happened with many RSA keys used in PGP years ago. The excerpt is truncated, so this item does not provide technical details of the eMudhra incident, the exact scope of the audit, or its results. To check these points, consult the original link given in the source, verify the date and author, and read the full discussion. The relevance for organizations lies in key hygiene for certificate authorities, which underpins trust in digital certificates. Rota Nacional does not solve this engineering problem. If you use AI to study this material, do not paste private keys, certificate files, credentials or internal system names into the prompt. Replace them with placeholders. The platform detects and applies policy to personal data such as CPF, CNPJ, e-mail, phone numbers and names before any model runs, but that protection does not cover cryptographic secrets, so do not rely on it for this kind of material.
Original source: Re: Comprometimento de intermediárias da eMudhra