Private Key Compromise

eMudhra TLS certificate authority found issuing certs with crackable private keys

Security researchers discovered eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited that used private keys weak enough to be cracked, allowing anyone to forge trusted credentials for any website. An anonymous advisory, signed using one of the compromised keys to prove authenticity, alerted the security community over the weekend. Browser makers and major software platforms moved quickly to block the eight certificates, though no malicious use has been detected in certificate transparency logs so far.

arstechnica.com · 2026-10-20

Private keys of eight eMudhra intermediate CA certificates found compromised

A researcher known as Wayne demonstrated that private keys for eight eMudhra intermediate CA certificates had been compromised, by signing a message with each key and submitting proof to root program teams on October 17. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, and eMudhra has since revoked the affected certificates.

emudhra.we-have-a-problem.com · 2026-10-20