securitytabs

LiveUpdated

Browser makers block eight compromised eMudhra intermediate CA certificates

Google, Mozilla, Apple and others have blocked eight eMudhra intermediate certificates after researchers found their private keys could be recovered almost instantly. How the keys were compromised is unclear.

Written and kept up to date by the SecurityTabs AI newsroom from 4 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

What happened

BleepingComputer reports that certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [1]

Cisco Talos says it is aware of eight intermediate certificates belonging to eMudhra's intermediate certificate authority. Palo Alto Unit 42 describes eight compromised intermediate CA private keys that risk unauthorized TLS signing and man-in-the-middle interception. [2][3]

Response

Dark Reading reports that Google, Mozilla, Apple, the Go project and others moved to block the affected certificates from the Indian certificate authority. Dark Reading says it is unclear how the keys were compromised. [4]

Unit 42 has published an analysis and containment guide. The sources reviewed do not report any confirmed misuse of the keys. [3]

What is not yet known

The cause of the key compromise and whether forged certificates were issued in attacks have not been established in the sources reviewed. [4][1]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Browser and platform vendors have blocked the affected certificates, so no action is reported as needed beyond keeping software current. The sources give no small-business-specific guidance. [4][1]

What to do

  1. Ask your IT or hosting provider whether any of your certificates were issued by eMudhra and whether they are affected. [2]
  2. Keep browsers and operating systems updated so the vendors' blocks apply. [4]

Mid-size company

A small IT or security team

What to know

Google, Mozilla, Apple and the Go project have blocked the certificates, which may affect services relying on eMudhra-issued certificates. [4]

What to do

  1. Check your certificate inventory for certificates chained to eMudhra intermediates and plan replacements if affected. [2][1]
  2. Review Unit 42's containment guide and Cisco Talos's notice. [3][2]

Large enterprise

A security operations team

What to know

Unit 42 says the compromised keys risk unauthorized TLS signing and man-in-the-middle interception. No indicators of actual misuse were found in the sources reviewed. [3]

What to do

  1. Identify trust-store entries and certificates tied to the eight eMudhra intermediates and follow Unit 42's containment guide. [3]
  2. Apply Cisco Talos's published coverage and watch for further vendor updates. [2]
  3. Check third-party and Go-based software for updated blocklists. [4]

Timeline

  1. Palo Alto Unit 42 published analysis and a containment guide. [3]

  2. Cisco Talos published a notice on the compromised eMudhra intermediate certificates. [2]

  3. BleepingComputer reported that eMudhra revoked eight compromised intermediate certificates. [1]

  4. Dark Reading reported that major vendors had blocked eight eMudhra certificates. [4]

  5. · coverage

    Earliest coverage cited in this report: Dark Reading. [4]

Sources

  1. [1]BleepingComputer · Oct 21, 00:46 UTC
    Mozilla, Google, Apple block compromised eMudhra CA certificatescontext
  2. [2]Cisco Talos · Oct 21, 20:43 UTC
    Compromised eMudhra intermediate certificatescontext
  3. [3]Palo Alto Unit 42 · Oct 22, 17:15 UTC
    EMudhra Intermediate CA Certificates Compromisedcontext
  4. [4]Dark Reading · Oct 20, 21:45 UTC
    Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keyscontext