eMudhra to Exit Public TLS Market After Eight Weak Intermediate Keys

Key points

• eMudhra will stop issuing publicly trusted TLS certificates.
• Eight intermediate CA private keys were deemed guessable.
• Browser vendors will distrust certificate chains tied to those keys.
• Administrators should inventory and replace eMudhra-issued certificates.

eMudhra, a certificate authority, has decided to withdraw from the public TLS certificate market after major browser makers moved to remove trust in its certificates. The trigger was the discovery that eight private keys tied to intermediate certificate authorities were weakly generated and could be guessed. No CVE has been assigned, but the trust consequences are direct: certificates chaining to the affected intermediates will no longer be accepted by mainstream browsers.

The impact falls on organizations that rely on eMudhra-issued server certificates for websites, APIs, or internal services. Once browser vendors enforce distrust, visitors may see warnings, and automated clients that follow browser trust stores may reject connections. Because the issue involves intermediate CA keys rather than a single leaf certificate, the blast radius can extend across many certificates issued under those intermediates.

This is a market-exit event rather than a routine certificate revocation. Browser root store programs set the trust rules for the public web, and a CA that cannot meet key-generation and audit expectations can lose distribution quickly. eMudhra’s decision to leave the public certificate business avoids a prolonged standoff, but it does not remove the operational work for customers who must migrate to another CA.

What to watch: the exact distrust dates and which intermediate certificates are affected, whether revocation services remain available during the transition, and how replacement certificate authorities handle reissuance timelines. Administrators should also watch certificate transparency logs for unexpected issuance under legacy intermediates and confirm that application trust stores, not just browsers, are updated.

What to do now

1. Inventory every certificate issued by eMudhra, including leaf certificates and chains that reference its intermediate CAs.
2. Obtain replacement certificates from a currently trusted public CA and schedule cutovers before browser distrust takes effect.
3. Remove or disable trust anchors and intermediate certificates associated with eMudhra in browsers, operating systems, and application trust stores where appropriate.
4. Audit key-generation practices for internal CAs and ensure private keys have sufficient entropy and are stored in hardware-backed systems.
5. Update certificate monitoring and certificate transparency alerting to catch unexpected issuance or lingering chains tied to the affected intermediates.
6. Notify application owners, API consumers, and vendors that rely on affected endpoints so they can update pinned certificates or trust configurations.

Original source

Hackread