eMudhra revokes 8 more CAs after RSA keys left HSMs
It cannot prove the eight RSA issuer keys complied with its HSM rules, and lists 195 affected certificates.
Stories per day · 30 days
5 RSS
Relatedcertificate-authority27emudhra24tls16emsign6code-signing4firefox4mozilla4ssl-tls4sectigo3weak-keys3ca-certificates2certificates2chrome2comodo2go2india2name-constraints2private-keys2
61 stories, newest first · one card per story
Stories tagged #pki
Researcher shows a Google C2PA chain with a trivial leaf key
David Buchanan says media tools often lack revocation and that a known C2PA issuance flaw breaks its trust model.
Sectigo survey finds TLS renewal confidence outruns automation
Of 500 leaders, 61% reported a certificate incident in the past year, while only 4% automate more than 90% of renewals.
Indian government sites still serve revoked eMudhra certificates
Of 8,947 IGOD hosts checked on October 23, 156 still presented certificates revoked on October 19.
eMudhra intermediate CA keys can be brute-forced, Cisco says
A researcher showed eight intermediate private keys from an April 2025 ceremony can be recovered in seconds.
eMudhra exits global TLS market after intermediate CA keys compromised
Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.
eMudhra exits global TLS business after weak certificate keys
Eight intermediates used 3- to 8-bit private keys that could be cracked in milliseconds to mint trusted certificates.
Comodo AAA Services root and S/MIME raised on oss-security
The October 22 post is truncated after Böck says he asked Mozilla what earlier messages meant.
InCommon intermediates named as eMudhra root collateral
Stuart Henderson lists three Internet2 InCommon intermediates plus eMudhra intermediates under emSign ECC Root CA - G3.
eMudhra Intermediate CA Private Keys Compromised
Eight eMudhra intermediate CA private keys generated with insufficient randomness were compromised, enabling private key derivation and unauthorized TLS certificate signing.
2
eMudhra exits global SSL/TLS issuance after weak CA private keys
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
1
eMudhra exits global SSL/TLS business after weak intermediate CA keys
Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.
eMudhra to exit the global SSL/TLS certificate business
The company says affected CAs were revoked within 14 hours, with no end-entity certificates and no data breach.
eMudhra to exit global SSL/TLS certificate business
A BSE filing says the firm will focus on enterprise solutions and trust services other than SSL/TLS.
NVD lists CVE-2026-111943 as a compromised intermediate CA
The captured NVD page is only site chrome, so vendor, versions, severity, and impact are not in the text.
1
Weak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
Ubuntu NSS update removes two root CAs after intermediate compromise
The notice drops emSign ECC Root CA - G3 and the Comodo AAA Services root from NSS.
eMudhra intermediate CA keys were single-byte and factorable
Eight April 2025 intermediates, also cross-signed by Sectigo, used P-384 private keys of one byte.
Browsers block eMudhra intermediate CAs with recoverable private keys
Eight April 2025 intermediates used near all-zero keys; browsers blocked them between October 17 and October 20.
oss-security reply praises handling of eMudhra intermediate compromise
The note suggests other CA root and intermediate keys should be checked for weak private keys.
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
Eight eMudhra intermediate CA private keys compromised
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
eMudhra CA private keys compromised, one was the number 4
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
1
Mozilla::CA before 20261020 includes a root tied to compromised intermediates
Stig Palmquist reported CVE-2026-113812 on October 20 against the libwww-perl CA bundle; the post is truncated.