eMudhra Exits SSL/TLS Market After Eight Intermediate CA Private Keys Were Found Guessable
What Happened — eMudhra, a globally‑operating Certificate Authority (CA), announced it will withdraw from the SSL/TLS certificate market after security researchers demonstrated that eight of its intermediate‑CA private keys could be derived with minimal effort. The keys were generated with insufficient entropy, making them effectively guessable. Browser vendors responded by distrusting certificates chained to those intermediates, and eMudhra voluntarily ceased issuing new certificates while advising customers to replace any still‑in‑use certificates. The issue was disclosed publicly in early October 2026, and eMudhra’s exit was confirmed in a statement to the press.
Why It Matters for Trust & Control Assurance — The incident highlights a failure in the cryptographic key‑management control objective: without strong key‑generation processes and continuous evidence of key entropy, an organization cannot reliably demonstrate control assurance across frameworks.
Who Is Affected — Technology‑as‑a‑Service providers, cloud‑infrastructure operators, and any organization that relied on eMudhra‑issued TLS certificates.
Recommended Actions —
- Inventory all certificates that chain to eMudhra intermediates and replace them promptly.
- Review and harden your own PKI key‑generation procedures (entropy sources, algorithm selection).
- Capture and retain evidence of key‑generation controls for audit readiness.
Technical Notes —
- Attack vector: Weak entropy in private‑key generation (vulnerability exploit).
- Data exposed: Eight intermediate‑CA private keys (credential compromise).
- Discovery: Independent security researcher demonstrated key‑guessability; no CVE assigned.