eMudhra Revokes Eight Compromised CA Certificates

eMudhra has revoked eight compromised intermediate certificate authority certificates after a researcher demonstrated signing capability with their private keys, prompting browser makers and software developers to block the certificates or issue fixes. The incident could allow someone holding a key to create certificates that clients might accept as genuine, but the available evidence does not establish that the keys were used to target users. The affected certificates connect to roots trusted by Mozilla, Google, Apple and Microsoft, among other systems. Six were authorized to issue website TLS certificates, while two were for code signing. On October 17, a researcher identified as Wayne signed a message using each of the eight keys and reported the compromise to root program teams. Mozilla cryptography engineer Dennis Jackson published the certificates, public keys and signatures so the demonstrations could be checked. Mozilla’s incident report says the keys were generated in April 2025 and were weak enough to be recovered by testing no more than 256 possible values. It attributes the weakness to eMudhra, which said a script error produced a second set of weaker keys that...