Sectigo - GoKawiil

eMudhra quits global SSL/TLS certificate business after key compromise

eMudhra is exiting the global SSL/TLS certificate market after private keys behind eight of its intermediate certificate authorities were compromised. The company will offer affected customers free Sectigo-issued replacement certificates and will keep revocation and status services running until all its certificates have expired or been replaced. eMudhra cited rising data sovereignty and compliance costs as additional factors in leaving the business.

it.slashdot.org · 2026-10-25

eMudhra revokes 8 CA certificates after researchers crack weak private keys

Certificate authority eMudhra revoked eight intermediate certificates after researcher Wayne found their P-384 private keys were generated with values under 256, making them trivially recoverable. eMudhra said a script error in April 2025 produced the weak keys, which were mistakenly used for signing instead of properly generated ones, and some were cross-signed by Sectigo. Mozilla, Google and Apple have since blocked the compromised certificates in their browsers and operating systems.

bleepingcomputer.com · 2026-10-20