eMudhra, an Indian certificate authority, has announced its exit from the global SSL/TLS certificate business following the recovery of private keys from eight of its intermediate CA certificates. The researcher reported the keys were easily guessable, undermining trust in PKI systems relying on eMudhra-issued certificates. The board's decision will affect customers worldwide, who will receive replacement certificates from partners at no cost.

What should defenders do?

Affected organizations should inventory systems relying on eMudhra-issued certificates and plan migration to alternative trusted CAs. eMudhra will provide free replacement certificates through partner channels. Browser and trust store updates may be required to revoke compromised intermediates.

highvulnerability

eMudhra Withdraws from Global SSL/TLS Certificate Business After Intermediate CA Key Compromise

Researcher recovers private keys of eight intermediate certificates; keys described as easily guessable

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

eMudhra Withdraws from Global SSL/TLS Certificate Business After Intermediate CA Key Compromise

Key Takeaways

eMudhra, an Indian certificate authority, is exiting the global SSL/TLS certificate business.
A researcher recovered the private keys of eight intermediate CA certificates issued by eMudhra.
The researcher described the keys as easily guessable, undermining PKI trust.

Related Security News

highCyber Attacks

Machine-Speed Attacks Outpace Human Response Times, Exaforce Warns

A new analysis from Exaforce, reported by BleepingComputer, reveals that attackers can steal credentials and begin exfiltrating data within minutes—often before human security teams can intervene. The report examines real-world attack scenarios involving stolen GitHub tokens, malicious AI installers, and MFA phishing campaigns, underscoring the critical need for machine-speed detection and automated containment.

BleepingComputer7 minutes ago1 min read