GoKawiileMudhra-issued intermediate CA certificates found with crackable private keys
Security researchers discovered that Indian certificate authority eMudhra issued six TLS and two code-signing intermediate certificates whose private keys were weak enough to be guessed or recovered. An attacker exploiting this could impersonate trusted websites such as banks or tech firms, or sign malware to appear as legitimate software from companies like Microsoft or Google. The affected certificates now need to be revoked and removed from trust stores across operating systems and browsers.
GoKawiil's interpretation of the reporting above, not reported fact.
Because browsers and operating systems rely on chains of trust rooted in CA certificates, a compromised intermediate CA can undermine the security of HTTPS connections and code-signing checks industry-wide, not just for one company's products. This incident adds to a growing list of CA trust failures, which could intensify scrutiny of certificate issuers' key-management practices and push browser makers toward faster revocation mechanisms. System administrators now face urgent work updating trust and revocation lists before attackers exploit the exposed keys.
- eMudhra issued 8 intermediate certificates with insecure, guessable private keys
- Attackers could use these to impersonate any website or sign malware as legitimate software
- Operating systems, browsers and applications must update their revocation lists to block the affected certificates
YubiKey 5C NFC Security Key — With certificate authorities and signing keys proving so fragile, hardware-backed authentication is more important than ever. A YubiKey lets you secure your accounts with phishing-resistant hardware keys instead of relying solely on fragile trust chains. It's a simple, durable way to add real protection against the kind of impersonation attacks this leak enables.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Bruno Ferreira, 2026-10-22
Published there as: “Leaked private keys for eight CA certificates let any attacker impersonate any domain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.