GoKawiileMudhra revokes 8 CA certificates after researchers crack weak private keys
Certificate authority eMudhra revoked eight intermediate certificates after researcher Wayne found their P-384 private keys were generated with values under 256, making them trivially recoverable. eMudhra said a script error in April 2025 produced the weak keys, which were mistakenly used for signing instead of properly generated ones, and some were cross-signed by Sectigo. Mozilla, Google and Apple have since blocked the compromised certificates in their browsers and operating systems.
GoKawiil's interpretation of the reporting above, not reported fact.
Since the flawed keys existed from April 2025 onward, attackers could theoretically have used them to forge trusted certificates and intercept encrypted traffic for months before discovery, though eMudhra says it has found no evidence of misuse. The incident highlights how a single automation error at a certificate authority can ripple across the entire web's trust infrastructure, prompting coordinated action from major browser vendors.
- Eight eMudhra intermediate certificates used P-384 keys with values under 256, letting anyone guess the key by testing just 256 possibilities.
- eMudhra attributes the flaw to a script error in April 2025 that generated and mistakenly used a weaker set of keys for signing.
- Mozilla, Google and Apple have blocked the compromised certificates, and eMudhra has revoked them and paused new issuance under its G3 root.
Source: bleepingcomputer.com, 2026-10-20
Published there as: “Mozilla, Google, Apple block compromised eMudhra CA certificates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.