eMudhra says weak keys left eight emSign G3 CA keys recoverable
Browsers are phasing out emSign G1 trust in November 2026; eMudhra says the G3 intermediates issued no public end-entity certificates.
Stories per day · 30 days
2 RSS
Relatedemudhra47pki27tls27emsign10firefox8code-signing7weak-keys7chrome5mozilla5private-keys5ssl-tls5python4trust-store4browser-trust3certifi3comodo3data-breach3digicert3
61 stories, newest first · one card per story
Stories tagged #certificate-authority
DigiCert breach exposes archived customer data and identity documents
An unauthorized account read archived records from June 27 to July 2, 2026, after a 2025 migration left an internal system online.
2
Cloudflare tracks forged certificates from eMudhra’s weak CA keys
About 22,000 handshakes presented the weak keys; Cloudflare says none intercepted its own connections.
1
macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
Microsoft emergency updates block compromised eMudhra certificates
Eight recoverable intermediate keys could forge TLS or code-signing certificates; Microsoft says its own systems were not affected.
Microsoft Windows updates remove trust in weak eMudhra certificates
October 26 updates target offline Windows systems after eight April 2025 intermediate keys proved recoverable.
Microsoft ships Windows trust-list update after eMudhra key compromise
The October 26 update removes seven eMudhra-related certificates for devices that do not get automatic CTL updates.
eMudhra thread: root CA notAfter period is 25 years
Jeffrey Walton corrects himself and cites CA/Browser Forum baseline requirements for root CA validity.
eMudhra intermediate CA keys can be brute-forced, Cisco says
A researcher showed eight intermediate private keys from an April 2025 ceremony can be recovered in seconds.
Python users urged toward truststore after eMudhra CA incident
A short oss-security reply says the CA incident should raise priority for replacing certifi with truststore.
eMudhra issued TLS certificates with private keys of 3 to 8 bits
Eight P-384 keys held only a handful of bits of entropy, so a network attacker could impersonate the certificate holder.
eMudhra exits global TLS market after intermediate CA keys compromised
Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.
Python users urged to prefer system stores after eMudhra CA incident
The reply says distribution pip and requests should use the system certifi store.
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
Python users pointed to eMudhra emSign CA certificate incident
The forwarded note only cites a Python discussion statement and a comment, without describing the certificate impact.
eMudhra exits global TLS business after weak certificate keys
Eight intermediates used 3- to 8-bit private keys that could be cracked in milliseconds to mint trusted certificates.
InCommon intermediates named as eMudhra root collateral
Stuart Henderson lists three Internet2 InCommon intermediates plus eMudhra intermediates under emSign ECC Root CA - G3.
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
1
eMudhra exits SSL/TLS business after weak CA keys found
Researcher recovered private keys of eight intermediate CAs that were below 256 bits, leading to root distrust and business exit.
eMudhra exits global SSL/TLS issuance after weak CA private keys
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
1
eMudhra ends certificate business after weak private keys cracked
Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.
2
eMudhra to exit the global SSL/TLS certificate business
The company says affected CAs were revoked within 14 hours, with no end-entity certificates and no data breach.
eMudhra to exit global SSL/TLS certificate business
A BSE filing says the firm will focus on enterprise solutions and trust services other than SSL/TLS.
NVD lists CVE-2026-111943 as a compromised intermediate CA
The captured NVD page is only site chrome, so vendor, versions, severity, and impact are not in the text.
1