eMudhra Issues Apology After Scripting Error Exposes Intermediate CA Keys
eMudhra has revoked eight intermediate certificate authorities after a security flaw allowed for the potential forgery of website certificates, though no active exploitation was detected.
eMudhra issued an apology on October 26 after a scripting error exposed the private keys of eight intermediate certificate authorities to recovery, which could have allowed attackers to forge website certificates.
Security researcher Wayne reported the flaw on October 17 after discovering the keys had an effective key space of only three to eight bits and demonstrating the issue on emudhra.we-have-a-problem.com. Intermediate certificate authorities connect trusted root authorities to website certificates, meaning anyone with a private key can issue fraudulent certificates and impersonate legitimate sites.
Browsers including Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge blocked the affected certificates by October 20. Cloudflare confirmed the risk on October 19 at around 17:00 UTC, found no evidence of active exploitation, and updated cloudflared, WARP, and 1.1.1.1.
eMudhra stated it revoked the affected authorities within 14 hours of confirming the issue and found no evidence of compromised customer data, systems, or issuance of publicly trusted certificates. The eight authorities originated from an April 2025 key-generation exercise for publicly trusted certificate infrastructure, leaving root keys, other intermediate authorities, enterprise apps, and regional digital-signature and eSign services unaffected.
Affected customers and TLS service users will receive free certificate replacements. eMudhra will publish a detailed investigation via the Common CA Database process, appoint an independent expert to review security controls, and implement further steps.