eMudhra apologises after a security report finds weak, easily computable private keys associated with eight of its intermediate certificate authorities (CAs). The company revoked the affected certificates, says it has found no evidence of misuse or compromise of its infrastructure or customer data, and says it revoked the intermediates within about 14 hours of the report. The weak keys were linked to certificates used for TLS website security and Windows code signing.
The incident is tied to how intermediate CAs sit in the certificate chain that allows clients to trust specific certificates. According to the reports, a key-generation ceremony produced a second set of keys alongside the intended strong keys, and the weak keys were used because of labeling/selection in certificate signing requests. The article summaries also note that exposure lasted for months, and that browser and OS trust responses differed by platform and timing.
As eMudhra exits the global SSL/TLS business, coverage also highlights the broader operational challenge for enterprises: ensuring systems update trust stores and certificate validation behavior across many runtimes and devices, beyond just mainstream browsers.
