eMudhra CA signing keys were so weak anyone could recover them
Original title: eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediates from an April 2025 ceremony used keys under 256; browsers blocked them, and about 30,000 customer certificates need replacement.
Researcher Wayne found on October 17 that eight eMudhra intermediate certificates used private keys small enough to recover from the public certificates in under a second. Six issue website TLS certificates and two are for code signing; Sectigo cross-signed all eight, and they chain to roots trusted by major browser vendors. Chrome, Firefox, Apple, and Microsoft blocked the certificates within days, eMudhra revoked them on October 18, and Mozilla removed trust in the signing root. The company blamed a faulty key-ceremony script.
Unconfirmed: It is unknown whether anyone used the keys in the 17 months before disclosure; eMudhra says only one intermediate was in production and none issued customer certificates.
- Wayne proved control by signing a message with each recovered key.
- Scott Helme said one private key was the number 4 and another was 56.
- The keys came from 24 intermediates generated on April 30, 2025.
- Google is still evaluating eMudhra’s remaining CA certificate.
- Devices that miss revocation updates may still trust the certificates.
Impact: Forge certificates to impersonate sites and intercept traffic
| Product | Affected |
|---|---|
| eMudhra intermediate CA certificates | eight intermediates from a batch of 24 generated April 30, 2025 |
- 1.Update browsers and operating systems so distrust and revocation take effect.
- 2.Administrators should refresh the certificate trust lists their systems use.
- 3.Replace customer certificates issued from the affected eMudhra root.
- Organizations
- MozillaCloudflare
- Countries
- India
From the original article
3 min read at helpnetsecurity.com
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.