Compromised eMudhra intermediate certificates

What it is

Cisco Talos reports eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys are trivially recoverable. During an April 30, 2025 key generation ceremony for 24 subordinate CAs under emSign Root TLS CA - G3, a flaw in a wrap/unwrap step produced a second set of weak keys. Those keys were mistakenly used for eight intermediates. Talos says the flaw left 3 to 8 of entropy instead of the full 384 bits. The post writes "384 bytes" and "3 – 8 bytes" in one place and "384 bits" in another, so the unit is unclear in the source. eMudhra has revoked the certificates and stopped issuing under its G3 root.

Preconditions / Affected

Anyone holding a recovered key can issue certificates that clients accept, within the intermediate's constraints and each client's validation controls. Abuse of a TLS intermediate also needs an attacker who can intercept or redirect the connection. The client must still trust the affected key, with no revocation, key distrust, CT enforcement or pinning in the way.

Chrome, Mozilla and Apple have blocked the six TLS intermediates. Microsoft has blocked the two code signing ones. Exposure remains in software with its own trust store or no revocation checking:

• VPN clients, proxies, load balancers and gateways with stale or separately managed trust stores.
• CI/CD runners and package managers that fetch over TLS. A forged certificate could enable registry impersonation, but it would not defeat lockfile hashes, checksums, signatures or provenance checks.
• Embedded and industrial devices with bundled CA stores and limited update paths.
• Go programs on platforms or static containers with embedded root pools that ignore revocation.

What to do

• Go: upgrade to Go 1.27.3 or 1.26.10 (CVE-2026-111943). These releases reject chains containing the SPKI SHA-256 hash of any of the eight intermediates. Talos names Docker, Kubernetes, Terraform and Prometheus as affected ecosystems, so rebuild binaries with the fixed toolchain.
• Check each TLS-using product for the trust-store, OS, firmware or application update it needs. Talos gives no per-product list.
• Snort coverage is SIDs 67363 to 67374.

To search trust stores or inventories, use these certificate SHA-256 fingerprints. The Go filter uses SPKI hashes, which are different values and are not listed in the post.

E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838  EM EV TLS CA - G3B
98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B  EM OV TLS CA - G3B
42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493  EM DV TLS CA - G3B
432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3  EM EV TLS CA - G3C
CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F  EM OV TLS CA - G3C
0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19  EM DV TLS CA - G3C
9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4  EM OV CS CA - G3B (code signing)
4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1  EM OV CS CA - G3C (code signing)

The G3B certificates belong to eMudhra BV and the G3C certificates to eMudhra Inc. The TLS ones chain to emSign Root TLS CA - G3 and the code signing ones to emSign Root CS CA - G3. Serials and CCADB IDs (A012294 to A012308) are in Mozilla's bug report, which Talos cites.

Caveats

As of October 21, 2026 14:00 UTC, Talos had seen no malicious use in the wild. Talos expects more patches from other vendors but names only Go and unspecified VPN software. It says the required action depends on each product's validation and update mechanism.