No items found.

October 21, 2026

Minutes Read

eMudhra Intermediate CA Private Key Compromise

Advisory

October 21, 2026

Minutes Read

eMudhra Intermediate CA Private Key Compromise

Advisory

October 21, 2026

Minutes Read

Kudelski Security Team

Find out more

table of contents

Share on

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

SUMMARY

Eight intermediate certificate authority (CA) certificates operated by the India-based CA eMudhra have private keys so weak that anyone can derive them from the public certificates. Anyone holding these keys can mint certificates for any website or service that clients chaining to the affected roots would accept. The incident was reported to Mozilla on 2026-10-17 by a researcher identified as "Wayne", who proved control of the keys by signing a short message with each of them.

The affected set is eight intermediates:

Six TLS intermediates:

- EM DV TLS CA - G3B

- EM DV TLS CA - G3C

- EM OV TLS CA - G3B

- EM OV TLS CA - G3C

- EM EV TLS CA - G3B

- EM EV TLS CA - G3C

Two code-signing intermediates:

- EM OV CS CA - G3B

- EM OV CS CA - G3C

These are issued under:

emSign Root TLS CA - G3 (TLS)
emSign Root CS CA - G3 (code-signing)

Each also exists as a Sectigo (AAA Certificate Services) cross-sign, bringing the total to 16 affected certificates.

eMudhra revoked all eight intermediates on 2026-10-18, and Sectigo revoked the cross-signed certificates by 2026-10-19. Mozilla, Chrome, Apple, and others have distributed blocks, and Mozilla emergency-distrusted emSign ECC Root CA - G3 on 2026-10-20.

Many clients do not consume revocation data and require software updates. Exposure may therefore persist in:

Non-browser software
Containers
Linux distributions
Embedded systems
IoT devices

No active exploitation has been confirmed.

AFFECTED SYSTEMS AND/OR APPLICATIONS

Certificates

The 16 certificates listed below:

8 affected intermediates
8 Sectigo (AAA Certificate Services) cross-signed versions

Potentially Affected Platforms

Clients and trust stores that trust these chains and do not consume revocation or Certificate Transparency (CT) data:

Non-browser TLS clients
Developer tools
Software packages bundling their own trust stores
Python ecosystem packages
Containers
Linux distributions not yet updated
Embedded devices
IoT devices
VPN clients

Go Applications

Binaries built with Go versions older than:

Go 1.27.3
Go 1.26.10

must be rebuilt.

Microsoft Platforms

Microsoft has remediated the issue through certificate revocation tooling and processes.

Apple Platforms

Apple has remediated the issue through certificate revocation tooling and processes.

Note: macOS users should be aware that the built-in curl utility does not check revocation information and may continue to trust affected certificates.

eMudhra Subscribers

Certificates chaining to emSign ECC Root CA - G3 are impacted and require migration.

eMudhra estimates approximately:

30,000 affected certificates
~97% issued through ACME

eMudhra has ceased issuance from affected chains.

emSign Root CA - G1 is not being removed.

Not Affected

Applications that do not rely on TLS for confidentiality, including:

Signal
WhatsApp
WireGuard

AFFECTED CERTIFICATES

|------------|---------|-----------|---------|----------|

DISTINCT PUBLIC KEYS

(SPKI SHA-256)

| Intermediate | SPKI SHA-256 |

|--------------|--------------|

| EM DV TLS CA - G3B | EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105 |

| EM DV TLS CA - G3C | 49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F |

| EM EV TLS CA - G3B | E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41 |

| EM EV TLS CA - G3C | 5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0 |

| EM OV CS CA - G3B | EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6 |

| EM OV CS CA - G3C | 92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30 |

| EM OV TLS CA - G3B | 43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B |

| EM OV TLS CA - G3C | 63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8 |

TECHNICAL DETAILS

Vulnerability Mechanism

The affected keys were weakly generated.
This is a key generation flaw, not a signature algorithm flaw.
The eight compromised keys originated from a batch of 24 intermediates produced during a single key ceremony on 2025-04-30.
Certificates contain NIST P-384 public keys.
The corresponding private keys reportedly had effective values of:

4, 56, 66, 115, 155, 156, 230, 237

rather than approximately 384 bits of entropy.

Preliminary Root Cause

According to eMudhra:

A flaw existed in the key ceremony script.
An approved test deviation occurred.
A second, weaker key pair was created onboard and mistakenly used for the CSR.
Human errors occurred at multiple points in the process.

Potential Abuse

An attacker in possession of a recovered private key could:

Create certificates for arbitrary hostnames.
Present those certificates to affected clients.
Successfully impersonate trusted services where revocation checks are absent.

This requires an active adversary-in-the-middle position such as:

Hostile Wi-Fi networks
University networks
ISP-level interception
State-sponsored network control

Certificate Transparency Protections

Researchers reported no Certificate Transparency entries associated with malicious use of these intermediates.

Google indicated that CT enforcement would have prevented affected TLS certificates from being trusted by default in Chrome.

Observed Exploitation

Known Facts

No exploitation has been confirmed.
No indicators of compromise have been published.
The researcher demonstrated successful recovery of all eight keys.
Mozilla independently recovered the keys.
Additional researchers also publicly reproduced the recovery process.

Demonstration Message

The recovered keys were used to sign:

We have a problem here - Wayne

Test Infrastructure

The researcher maintains test hosts presenting chains built from compromised intermediates for validation purposes.

These systems have not been independently evaluated.

KEY POINTS

Scope

The affected set consists of:

8 intermediates
16 total certificates including cross-signs
6 TLS intermediates
2 code-signing intermediates

Timeline (UTC)

| Date | Event |

|--------|--------|

| 2025-04-30 | Key ceremony and certificate creation |

| 2026-10-17 20:06 | Report submitted to Mozilla |

| 2026-10-17 22:59 | Mozilla distrusted intermediates via OneCRL |

| 2026-10-18 09:24-09:38 | eMudhra revoked all eight intermediates |

| 2026-10-19 14:55 | Sectigo completed revocation of cross-signs |

| 2026-10-19 | Apple shipped revocations/protections |

| 2026-10-20 | Mozilla emergency-distrusted emSign ECC Root CA - G3 |

| 2026-10-20 | Microsoft blocked affected certificates |

| 2026-10-20 | eMudhra ceased G3 issuance |

| 2026-10-20 | Chrome announced similar action |

| 2026-10-20 | Cloudflare completed mitigations |

| 2026-10-21 | Firefox 158.0.2 fixed Android blocklist issue |

Long-Term Concerns

Go maintainer Filippo Valsorda warned that cleanup may exceed the impact duration of Heartbleed due to:

IoT devices
Containers
Legacy Linux systems
Embedded firmware
Software bundling root stores

MITIGATION

Immediate Actions

Limit Exposure

Do not disable TLS certificate validation.
Treat non-browser TLS clients as potentially exposed until trust stores are verified.
Review:

- mTLS trust stores

- Uploaded CA certificates

- Origin certificates

- Container images

- Application dependencies

Cloudflare Users

Review:

Full (strict) TLS configurations
Strict TLS configurations
Origin certificate chains

Consider HTTPS egress interception where appropriate.

Researcher Mitigations

The researcher has published:

Manual distrust procedures
PowerShell scripts

These have not been independently evaluated. Prefer vendor-supported updates.

Patch / Upgrade

Operating Systems and Browsers

Update browsers and operating systems.
Android Firefox users should run:

- Firefox 158.0.2 or later

Linux

Apply:

ca-certificates
Equivalent trust-store updates

once made available by your vendor.

Go

Rebuild applications using:

Go 1.27.3
Go 1.26.10

or later.

Containers

Rebuild container images.
Redeploy workloads.
Update bundled trust stores.

Cloudflare Products

| Product | Version |

|----------|----------|

| Cloudflare One Client Android | 2.5.7 |

| Cloudflare One Client iOS | 1.12.7 |

| Cloudflare One Client Desktop | 2026.8.2115.0 |

| 1.1.1.1 Android | 6.38.11 |

| 1.1.1.1 iOS | 6.31.8 |

| 1.1.1.1 Desktop | 2026.8.2115.0 |

| cloudflared | 2026.10.2 |

Windows and Apple

Apply the latest vendor updates.

eMudhra Subscribers

Organizations using certificates chaining to emSign ECC Root CA - G3 should migrate to an unaffected chain.

eMudhra is migrating customers to the G1 (RSA) hierarchy.

WHAT THE CYBER FUSION CENTER IS DOING

The Cyber Fusion Center (CFC) is monitoring the situation and analyzing the case for potential threat-hunting opportunities.

This advisory will be updated as new information becomes available.

REFERENCES

Mozilla Bugzilla 2083449

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Cloudflare: 8 eMudhra certificates are compromised. Here's what you need to know

https://blog.cloudflare.com/emudhra-certificate-compromise

Researcher Advisory

https://emudhra.we-have-a-problem.com

Impacted Intermediate Certificate List

https://github.com/galadran/we-have-a-problem.com/blob/main/impacted-intermediates.json

Dark Reading: Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys

https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys

Ars Technica: The internet goes on high alert after discovery of 8 compromised TLS certs

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

October 21, 2026

Security Advisory:

October 21, 2026

Kudelski Security Team

PHP Critical Remote Code Execution Vulnerabilities

CVE-2026-109618

CVE-2026-109619

October 20, 2026

Security Advisory:

October 20, 2026

Kudelski Security Team

ConnectWise Cloud Backup (formerly SkyKick) Vendor Credential Abused Against Microsoft 365 Tenants

October 16, 2026

Security Advisory:

October 16, 2026

Kudelski Security Team

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

CVE-2026-102764