Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

Summary: Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates were compromised, after a researcher reported it on the evening of October 17 and Chrome and Firefox blocked the certificates within hours. eMudhra said a flaw in its April 30, 2025 key generation ceremony produced a second, weak set of keys alongside the intended ones, and that the weak set was what got published to browser root stores.
Key Takeaway: The keys did not have to be stolen: they were generated with too little randomness, so anyone can compute them from the public certificates, and researcher Scott Helme recovered all eight on a laptop in under a second. Chrome's removal of emSign ECC Root CA - G3 is expected to reach every device relying on its root store on the morning of October 27, Pacific time, so website operators chaining to that root must install a certificate from another hierarchy before then.

Read the original at The Hacker News ↗