Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

eMudhra exits global SSL/TLS business after weak CA keys

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

eMudhra is leaving global SSL/TLS issuance after eight weak intermediate keys led browsers to distrust its ECC root.

eMudhra is voluntarily leaving the global SSL/TLS certificate business after eight intermediate CA private keys proved to be tiny integers rather than random P-384 values. CyberScoop and The Record credit Scott Helme with recovering them; Cyber Security News names researcher Wayne. The company says an April 2025 ceremony flaw published the keys, that it revoked the certificates within 14 hours, that those intermediates issued no end-entity certificates, and that its infrastructure was not compromised. Mozilla has removed emSign ECC Root CA – G3, with Chrome’s removal set for October 27; CERT-In and Okta report no confirmed exploitation. About 30,000 other certificates need migration—The Hacker News cites 30,800 in Chrome logs—while Google told CSO it found none chaining to the weak intermediates. A October 23 check found 156 Indian government hosts still serving certificates revoked on October 19.

Key facts
  • Eight P-384 intermediate keys were integers under 256, including 4; six were TLS and two code-signing.
  • eMudhra says those intermediates issued no end-entity certificates and were revoked within 14 hours.
  • Mozilla removed emSign ECC Root CA – G3; Chrome’s removal was scheduled for October 27.
  • CERT-In and Okta reported no confirmed malicious exploitation of the weak keys.
  • The company will offer free replacements and keep revocation services and G1 RSA roots during transition.
  • CyberScoop reports eMudhra shares fell 40% in the two days after disclosure.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Weak intermediate keys reported; browsers began blocking them. · Okta Security
  2. Oct 18, 2026The eight affected intermediate certificates were revoked. · Lobsters
  3. Oct 19, 2026eMudhra revoked 9,356 certificates on its G1 hierarchy. · Lobsters
  4. Oct 21, 2026CERT-In reported no confirmed malicious exploitation. · Cyber Security News
  5. Oct 22, 2026eMudhra announced its exit from global SSL/TLS issuance. · CyberScoop
  6. Oct 23, 2026Scan found 156 government hosts still serving revoked certificates. · Lobsters

What each outlet adds

beyond the shared facts
  • The RegisterLists all eight integer key values and a wrap/unwrap ceremony flaw.
  • CyberScoopKeys recovered on a laptop in under a second; shares fell 40%.
  • CSO OnlineGoogle found no CT certificates chaining to the weak intermediates; Sectigo replacements.
  • Okta SecurityOkta and Auth0 are removing trust and report no exploitation.
  • Lobsters156 Indian government hosts still served certificates revoked October 19.
Vendors
eMudhraSectigoAzulGoogleMozillaAppleMicrosoftOktaAuth0
Products
ChromeFirefoxemSign ECC Root CA – G3Chrome Root StoreAzul ZuluAzul PrimeCertiNextemSign ECC Root CA - G3emSign Root CA - G1
Organizations
CERT-INMozillaAppleGoogleCloudflareGartnerIDCSecurity BrigadeCERT-InMeitYUIDAISTPI
Countries
IndiaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 8d ago Cyber Security NewsFirst report

    eMudhra exits global SSL/TLS business after weak intermediate CA keys

    Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.

  2. · 8d ago CyberScoop

    eMudhra ends certificate business after weak private keys cracked

    Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.