eMudhra Intermediate CA Private Keys Compromised
Original title: EMudhra Intermediate CA Certificates Compromised
Eight eMudhra intermediate CA private keys generated with insufficient randomness were compromised, enabling private key derivation and unauthorized TLS certificate signing.
Indian CA eMudhra Limited suffered a critical cryptographic defect during certificate generation, producing private keys derivable from public certificates. Attackers can now sign unauthorized public TLS certificates and perform MitM, impersonation or session hijacking. Major browser and OS vendors revoked or untrusted the affected intermediate CAs. eMudhra revoked the eight certificates. Palo Alto Networks recommends auditing PKI assets, reissuing certificates, updating trust stores, enforcing revocation checking, and implementing CT monitoring and CAA records.
Unconfirmed: Exact number of affected systems unknown
- Private keys generated with insufficient randomness
- Derivable from public certificates
- Enables unauthorized TLS certificate signing
- Major browsers and OS vendors revoked the CAs
- eMudhra revoked the eight certificates
Impact: Derivation of private keys and unauthorized signing of TLS certificates
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra Limited intermediate certificate authority certificates | — | revoked |
- 1.Audit public and internal PKI assets
- 2.Immediately reissue certificates through alternative CA
- 3.Force emergency trust store updates
- Organizations
- Major browser and operating system vendors
- Countries
- India
From the original article
4 min read at unit42.paloaltonetworks.com
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.