Weak eMudhra keys expose eight trusted intermediate certificates
Original title: eMudhra Security Incident Exposes Weak Private Keys Used to Sign Trusted Certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
Researchers recovered eight eMudhra intermediate certificate private keys from public certificate data after finding the P-384 keys were integers below 256. Six TLS intermediates were trusted by major browser root programs and two code-signing intermediates by Microsoft. Firefox, Chrome, Apple, and Microsoft blocked the intermediates, and eMudhra and Sectigo revoked affected certificates. Clients that do not check revocation may stay exposed until trust stores update.
Unconfirmed: No Certificate Transparency entries showed browser exploitation; attacks on non-browser clients are unknown, and eMudhra's investigation is ongoing.
- Mozilla's Dennis Jackson said all eight affected keys were below 256.
- The keys were generated during a ceremony on April 30, 2025.
- Researcher Wayne proved control and notified root programs on October 17.
- eMudhra estimates about 30,000 certificates need migration, 97 percent via ACME.
- Recommended updates include NSS 3.131.1, certifi 2026.10.19, and pip 26.2.2.
Impact: recovery of eight intermediate certificate private keys
- 1.Update browsers, operating systems, development runtimes, and certificate bundles.
- 2.Install NSS 3.131.1, Python certifi 2026.10.19, or pip 26.2.2 where used.
- 3.Review application-bundled CA stores separately from browser trust stores.
From the original article
2 min read at gbhackers.com
Researchers discovered that private keys could be extracted from public certificate data, compromising eight intermediate certificates from eMudhra’s Certificate Authority. The incident, publicly disclosed on October 20, 2026, prompted emergency blocks across browser platforms and trust stores and revealed failures in the authority’s cryptographic key generation process.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.