eMudhra thread: root CA notAfter period is 25 years
Jeffrey Walton corrects himself and cites CA/Browser Forum baseline requirements for root CA validity.
16
Vendor
eMudhra
- Mentions · 7d40
- Mentions · 30d40
- All mentions40
- First seenOct 20, 2026
- Last mentioned1d ago
Timeline
40 articles · newest firstIndian government sites still serve revoked eMudhra certificates
Of 8,947 IGOD hosts checked on October 23, 156 still presented certificates revoked on October 19.
74
eMudhra intermediate CA keys can be brute-forced, Cisco says
A researcher showed eight intermediate private keys from an April 2025 ceremony can be recovered in seconds.
78
Python users urged toward truststore after eMudhra CA incident
A short oss-security reply says the CA incident should raise priority for replacing certifi with truststore.
28
virtualenv 21.14.11 noted for Python users after emSign CA incident
The release vendors pip and requires python-discovery 1.6.1 or newer.
28
eMudhra exits global TLS market after intermediate CA keys compromised
Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.
76
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
Python developer urges packages to stop vendoring CA roots
The reply says distribution ca-certificates should be the default, with certifi used as a dependency only when necessary.
18
Python users pointed to eMudhra emSign CA certificate incident
The forwarded note only cites a Python discussion statement and a comment, without describing the certificate impact.
36
InCommon intermediates named as eMudhra root collateral
Stuart Henderson lists three Internet2 InCommon intermediates plus eMudhra intermediates under emSign ECC Root CA - G3.
44
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
78
eMudhra exits SSL/TLS business after weak CA keys found
Researcher recovered private keys of eight intermediate CAs that were below 256 bits, leading to root distrust and business exit.
60
eMudhra exits global SSL/TLS issuance after weak CA private keys
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
64
eMudhra ends certificate business after weak private keys cracked
Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.
76
eMudhra exits global SSL/TLS business after weak intermediate CA keys
Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.
72
eMudhra to exit the global SSL/TLS certificate business
The company says affected CAs were revoked within 14 hours, with no end-entity certificates and no data breach.
48
eMudhra to exit global SSL/TLS certificate business
A BSE filing says the firm will focus on enterprise solutions and trust services other than SSL/TLS.
32
Node.js patches Brotli decoder bug that may allow code execution
Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.
76
eMudhra says ceremony flaw published weak certificate keys
One signing key was the number 4, letting attackers forge certificates and impersonate sites.
74
Weak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
78
eMudhra CA key compromise linked to weak keys
The excerpt is site navigation; it does not describe how the keys were weak, what was exposed, or any fix.
40
eMudhra CA signing keys were so weak anyone could recover them
Eight intermediates from an April 2025 ceremony used keys under 256; browsers blocked them, and about 30,000 customer certificates need replacement.
86
eMudhra intermediate CA keys were single-byte and factorable
Eight April 2025 intermediates, also cross-signed by Sectigo, used P-384 private keys of one byte.
78
Browsers block eMudhra intermediate CAs with recoverable private keys
Eight April 2025 intermediates used near all-zero keys; browsers blocked them between October 17 and October 20.
78
Google and Mozilla revoke eight eMudhra intermediates after weak keys
Keys were trivially recoverable from public certificates; Google saw no chaining TLS certificates in CT logs before blocking.
80
Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
78
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
74
eMudhra CA private keys compromised, one was the number 4
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
86
Eight eMudhra intermediate certificate keys compromised, Cloudflare says
Cloudflare says it has not seen exploitation on its services and has shipped client and tunnel updates.
88
Tech giants block eMudhra certificates tied to 8 compromised keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
78
Eight eMudhra TLS certificates had private keys of 3 to 8 bits
The private keys were the integers 4, 56, 66, 115, 155, 156, 230 and 237, versus a normal P-384 key.
74
Mozilla opens its eMudhra intermediates tracking bug to the public
Alan Coopersmith says restrictions on Mozilla bug 2083449 were removed on October 20.
22
eMudhra intermediate CA key compromise triggers browser blocks
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
84
Chrome and Firefox drop eMudhra root after certificate compromise
Whether Edge, Internet Explorer, cURL, and other private root stores still trust eMudhra is unconfirmed.
62
Eight eMudhra intermediate CA keys compromised; browsers block them
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
86
Mitigation posted for the eMudhra intermediate CA compromise
Systems that do not receive CRL updates are told to disable emSign ECC Root CA - G3 and the Comodo AAA Services root.
74
Mozilla alerts Firefox users after eMudhra intermediate compromise
The notice reached the distros list a day before this oss-security forward and points to a Mozilla security post.
70
Mozilla blocks eight compromised eMudhra intermediate certificates
OneCRL reached standard Firefox users in under three hours; 158.0.1 and two ESR builds cover the rest.
74
Go 1.27.3 and 1.26.10 block eight CA keys
Rebuilt Go programs reject chains through the keys, with no disable switch, and older unsupported releases get no fix.
76
Related CVEs
by mentions- CVE-2026-111943<1%—On most platforms, Go uses the given system root certificates
- CVE-2026-11149733%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- TLS hostname check bypass in Node.js 24.x and 26.x
- CVE-2026-105482<1%7.4NUL-byte truncation in Node.js dns.resolve* and dns.reverse
- TLS hostname mismatch in Node.js for leading-zero IPv4
- A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…
- A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request
- A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…
- A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule
- A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks
Appears with
- Mozillaorganization · 17
- Firefoxproduct · 13
- Chromeproduct · 11
- Mozillavendor · 9
- Googlevendor · 9
- Applevendor · 8
- Cloudflareorganization · 7
- Microsoftvendor · 7
- Googleorganization · 7
- Appleorganization · 6
- NSSproduct · 5
- emSign ECC Root CA – G3product · 5
- Sectigovendor · 4
- certifiproduct · 3
- emSignproduct · 3
- Govendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.