eMudhra CA Weak-Key Incident: Eight Intermediate Certificate Keys Found Recoverable

What happened

On Oct 17, an independent security researcher found that the private keys of eight intermediate CAs in Indian certificate authority eMudhra's global TLS business had insufficient randomness and could be recovered, and reported the finding to the Apple, Google, Microsoft and Mozilla root programs. Google and Mozilla pushed blocks to Chrome and Firefox within two hours; the incident was publicly disclosed on Oct 20.

On Oct 21 eMudhra issued an official statement: the flaw traced to a key generation ceremony on April 30, 2025, where a key wrap/unwrap step produced a second set of weak keys alongside the original strong keys — and it was the weak set that got published to browser root stores. The company said its infrastructure was not compromised and no data was breached, and that all eight intermediates were revoked on Oct 18.

The same day India's CERT-In issued a security advisory urging users to update browsers and operating systems and replace affected certificates, warning that removal of the root could disrupt some legitimate websites; the Ministry of Electronics and IT (MeitY) has formed a special investigation team. Mozilla removed the issuing root emSign ECC Root CA – G3 in NSS 3.131.1 on Oct 20; Chrome expects to complete removal of the same root on all devices by Oct 27.

Key facts

1. Scope: Eight intermediate CAs: six could issue TLS certificates and two code-signing certificates; in principle anyone holding the weak keys could mint trusted certificates for any website or software (certera).
2. Dwell time: The weak keys existed in browser trust stores for about 18 months after being generated in April 2025 before discovery, passing two years of independent audits (eMudhra statement, YourStory).
3. Browser response: Chrome blocked via SPKI, Firefox via OneCRL; Mozilla removed emSign ECC Root CA – G3 from NSS; Sectigo revoked cross-signed copies; Mozilla is not removing emSign Root CA – G1 for now (per malware.news).
4. Downstream fix IDs: The Go crypto/x509 block is tracked as CVE-2026-111943 and the Firefox OneCRL update as CVE-2026-113470 (rated High by Mozilla, MFSA 2026-111; per malware.news).
5. No observed abuse: No fraudulent certificates from these intermediates appeared in Certificate Transparency logs (certera); eMudhra says its infrastructure was not compromised and no data was breached (company statement).