Eight eMudhra intermediate CA keys could be recovered from their own certificates

Dennis Jackson of Mozilla published a disclosure on October 20: the private keys of eight eMudhra intermediate CA certificates are compromised. The intermediates chain to roots in the Mozilla, Microsoft, Apple and Chrome root programs. Six issue TLS certificates (DV, OV and EV) and two issue code-signing certificates. A reporter identified as Wayne sent the root programs proof on October 17, a message reading “We have a problem here” signed with each intermediate’s key. Mozilla’s preliminary analysis in Bugzilla 2083449 found the eight P-384 private keys were integers below 256 and could be recovered almost instantly.

eMudhra’s preliminary account in the bug traces the keys to an April 30, 2025 key ceremony. It says a flaw in the key-generation script created a second, weaker key pair on the HSM, and staff used that pair for the CSR because the key labels were similar. eMudhra’s root signed the CSR, and Sectigo cross-signed some of the intermediates. eMudhra revoked all eight on October 18. Firefox and Chrome began blocking them on October 17, Apple on the 19th and Microsoft on the 20th. Mozilla has since decided to remove trust in emSign ECC Root CA - G3. eMudhra says about 30,000 certificates need to move to other intermediates, about 97% of them issued through ACME.

The disclosure says certificate transparency logs show that browsers enforcing CT could not have been attacked. It cannot say the same for non-browser clients, many of which do not check revocation and need updated trust stores. It lists patched packages across Linux distributions, language runtimes and tools. Simon Willison notes uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 for Python.

The STI certificates that sign SHAKEN calls have no transparency logging. draft-ietf-stir-certificate-transparency, which would add it, went to the IESG with a publication request in May. Disclosure: I’m a co-author of that draft.

eMudhra says its HSMs are FIPS 140-2 Level 3 compliant. The keys were still smaller than 256.