eMudhra revokes eight more intermediate CAs after key review
Original title: eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure
Those eight keys were not weak, but missing handling proof brings revoked intermediates to 16.
eMudhra revoked eight more intermediate certificate authorities after reviewing the April 30, 2025 key ceremony behind its October failure. A Python script bug had reduced eight other P-384 keys to values under 256, which a researcher rebuilt and used to sign messages. The newly revoked keys were not weak, but eMudhra could not show they met its handling rules. Browser and OS vendors are removing remaining eMudhra trust.
Unconfirmed: It is unknown whether anyone used the weak keys maliciously; eMudhra says no data was breached and the affected intermediates issued no website certificates.
- A script shrank eight keys to values such as 4, 56, 66, and 237.
- Wayne reported the weak keys on October 17; the first eight were revoked on October 18.
- Chrome and Firefox blocked them that day; Microsoft followed on October 20 and Apple on October 22.
- About 30,000 certificates needed replacement, and about 97 percent used ACME.
- Microsoft will drop remaining eMudhra roots from Windows, Edge, and WebView2 starting November 16.
Impact: Trivially guessable intermediate CA private keys
| Product | Affected |
|---|---|
| eMudhra intermediate certificate authorities | 16 intermediates, including EM DV TLS CA – G2B and G2C under emSign Root TLS CA – G1 |
- 1.Update browsers, operating systems, and runtimes that still trust eMudhra roots.
- 2.Check apps, containers, and build servers that ship their own certificate bundles.
- 3.On Macs, verify git and curl after updating to the listed macOS builds.
- Vendors
- eMudhra
From the original article
3 min read at cybersecuritynews.com
eMudhra has revoked eight more intermediate certificate authorities (CAs). It took this step after a deeper review of the key ceremony that caused its October security failure. The new group did not have weak keys, but eMudhra could not prove the keys were handled the way its own rules require.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.