Indian government sites still serve revoked eMudhra certificates
Of 8,947 IGOD hosts checked on October 23, 156 still presented certificates revoked on October 19.
Stories per day · 30 days
Relatedcertificate-authority39tls26pki22firefox9certificates7emsign7weak-keys6chrome5code-signing5private-keys5go4mozilla4python4trust-store4browser-trust3certifi3india3sectigo3
18 stories, newest first · one card per story
Stories tagged #emudhra
Eight eMudhra intermediate CA private keys compromised
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
Python users urged to prefer system stores after eMudhra CA incident
The reply says distribution pip and requests should use the system certifi store.
eMudhra exits global TLS business after weak certificate keys
Eight intermediates used 3- to 8-bit private keys that could be cracked in milliseconds to mint trusted certificates.
eMudhra exits global TLS market after intermediate CA keys compromised
Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.
Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.
eMudhra exits global SSL/TLS issuance after weak CA private keys
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
1
Node.js patches Brotli decoder bug that may allow code execution
Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.
eMudhra says ceremony flaw published weak certificate keys
One signing key was the number 4, letting attackers forge certificates and impersonate sites.
mitmproxy commit adds an --emudhra option
The Hacker News post shows only a score of 42 points and eight comments, with no description of the flag.
PHP, Node.js, LiteLLM and an Indian CA hit in one day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
Bundled root stores may include compromised eMudhra certificate
Hanno Böck found the affected Comodo AAA Services certificate in Gentoo's texlive curl CA bundle.
eMudhra CA key compromise linked to weak keys
The excerpt is site navigation; it does not describe how the keys were weak, what was exposed, or any fix.
eMudhra CA private keys compromised, one was the number 4
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
1
Eight eMudhra intermediate certificate keys compromised, Cloudflare says
Cloudflare says it has not seen exploitation on its services and has shipped client and tunnel updates.
Eight eMudhra TLS certificates had private keys of 3 to 8 bits
The private keys were the integers 4, 56, 66, 115, 155, 156, 230 and 237, versus a normal P-384 key.
Go 1.27.3 and 1.26.10 block eight CA keys
Rebuilt Go programs reject chains through the keys, with no disable switch, and older unsupported releases get no fix.
4
Go will reject certificate chains with eight distrusted SPKIs
A reader of the change says 16 certificates, all from eMudhra, appear to match.