/
← Voltar ao feed
high technology certificate authorities

eMudhra CA key-generation flaw exposes eight weak P-384 intermediate private keys, prompting emergency distrust

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 01:55 · coletado há 3 horas

Researchers found that the private keys of eight eMudhra intermediate CA certificates could be recovered from public certificate data. Each P-384 key was an integer below 256, so near-instant recovery by simple enumeration or a discrete logarithm algorithm was possible. The incident was disclosed on October 20, 2026, and Mozilla, Google, Apple and Microsoft blocked the affected intermediates. Mozilla also requested an emergency distrust of the emSign ECC Root CA – G3. The article reports no Certificate Transparency evidence of exploitation against CT-enforcing browsers, but abuse against non-browser clients is unknown.

Technical Details

  • Affected: six TLS intermediates trusted by major root programs and two code signing intermediates trusted by Microsoft, all in eMudhra's G3B and G3C series. Sectigo cross-signs containing the same public keys were also revoked.
  • Mozilla's Dennis Jackson reported that all eight P-384 keys were below 256, so the encoded values were nearly zero except for the final byte.
  • The keys were generated at a ceremony on April 30, 2025. Researcher Wayne proved control of the keys by signing the message "We have a problem here – Wayne" with each one and notified root programs on October 17. Mozilla independently recovered the keys that evening.
  • eMudhra's preliminary findings: a modified key-generation script added a wrap/unwrap test for exportable keys. Strong keys were created in HSMs, but flawed code also produced weak alternatives. Similar labels led staff to select the weak keys when creating CSRs. Earlier invalid CRL signatures were linked to this mismatch, and the CRLs were later signed with the compromised keys. eMudhra cited multiple human errors, and its investigation is ongoing.
  • Timeline: Firefox and Chrome blocked the intermediates on October 17, Apple on October 19 and Microsoft on October 20. eMudhra revoked the eight certificates on October 18, followed by Sectigo's cross-signs.
  • eMudhra halted issuance under the emSign ECC Root CA – G3 and estimates about 30,000 certificates need migration, 97% of them issued via ACME.

Remediation

  • Update browsers, operating systems, development runtimes and certificate bundles. Recommended versions: NSS 3.131.1, Python certifi 2026.10.19 and pip 26.2.2.
  • Assess bundled trust stores separately, since browser protection does not cover command-line tools or applications that ship their own CA bundles.
  • Clients without effective revocation checking may remain exposed until their software or trust stores are updated.
  • Plan migration of certificates issued under the emSign ECC Root CA – G3.

Linha do tempo

  1. gbhackers.com ↗ · pub. 21/10/2026 01:55 · coletado 21/10 02:00 primeiro registro

    eMudhra CA key-generation flaw exposes eight weak P-384 intermediate private keys, prompting emergency distrust

    ler a análise desta fonte

    Researchers found that the private keys of eight eMudhra intermediate CA certificates could be recovered from public certificate data. Each P-384 key was an integer below 256, so near-instant recovery by simple enumeration or a discrete logarithm algorithm was possible. The incident was disclosed on October 20, 2026, and Mozilla, Google, Apple and Microsoft blocked the affected intermediates. Mozilla also requested an emergency distrust of the emSign ECC Root CA – G3. The article reports no Certificate Transparency evidence of exploitation against CT-enforcing browsers, but abuse against non-browser clients is unknown.

    Technical Details

    • Affected: six TLS intermediates trusted by major root programs and two code signing intermediates trusted by Microsoft, all in eMudhra's G3B and G3C series. Sectigo cross-signs containing the same public keys were also revoked.
    • Mozilla's Dennis Jackson reported that all eight P-384 keys were below 256, so the encoded values were nearly zero except for the final byte.
    • The keys were generated at a ceremony on April 30, 2025. Researcher Wayne proved control of the keys by signing the message "We have a problem here – Wayne" with each one and notified root programs on October 17. Mozilla independently recovered the keys that evening.
    • eMudhra's preliminary findings: a modified key-generation script added a wrap/unwrap test for exportable keys. Strong keys were created in HSMs, but flawed code also produced weak alternatives. Similar labels led staff to select the weak keys when creating CSRs. Earlier invalid CRL signatures were linked to this mismatch, and the CRLs were later signed with the compromised keys. eMudhra cited multiple human errors, and its investigation is ongoing.
    • Timeline: Firefox and Chrome blocked the intermediates on October 17, Apple on October 19 and Microsoft on October 20. eMudhra revoked the eight certificates on October 18, followed by Sectigo's cross-signs.
    • eMudhra halted issuance under the emSign ECC Root CA – G3 and estimates about 30,000 certificates need migration, 97% of them issued via ACME.

    Remediation

    • Update browsers, operating systems, development runtimes and certificate bundles. Recommended versions: NSS 3.131.1, Python certifi 2026.10.19 and pip 26.2.2.
    • Assess bundled trust stores separately, since browser protection does not cover command-line tools or applications that ship their own CA bundles.
    • Clients without effective revocation checking may remain exposed until their software or trust stores are updated.
    • Plan migration of certificates issued under the emSign ECC Root CA – G3.