Affected Systems

Eight intermediate Certificate Authority (CA) private keys from eMudhra Limited (Indian CA). Affects any TLS/SSL certificates issued by these compromised intermediates, including public-facing services, VPNs, APIs, and internal infrastructure relying on eMudhra-issued certificates. Major browsers and OS vendors have revoked or distrusted the affected intermediates.

Exploitation Status

Active exploitation risk. Private keys were compromised due to insufficient randomness during generation, allowing attackers to derive keys from public certificates and sign unauthorized TLS certificates. No confirmed active exploitation reported, but the cryptographic weakness enables man-in-the-middle attacks, impersonation, and session hijacking. eMudhra has revoked the eight certificates.

Business Impact

Organizations using eMudhra-issued certificates face immediate risk of man-in-the-middle interception, session hijacking, and impersonation attacks. Attackers can sign fraudulent certificates for any domain, bypassing TLS trust. This affects web services, VPNs, APIs, and any system trusting eMudhra intermediates. Certificate reissuance and trust store updates are required across all endpoints, servers, and containers. Supply chain risk extends to embedded certificates in code repositories, Docker images, and mobile apps.

Urgency

🔴 Immediate

Recommended Actions

  • Inventory all TLS/SSL certificates across public and internal infrastructure; identify any chaining to eMudhra intermediate CAs and immediately revoke and reissue through an alternative trusted CA
  • Deploy emergency trust store updates via MDM to all endpoints, servers, and container images to explicitly distrust the eight compromised eMudhra intermediate CAs
  • Enforce strict CRL and OCSP revocation checking on web proxies, API gateways, firewalls, and security appliances to block connections using revoked eMudhra certificate chains
  • Search code repositories, Docker images, build pipelines, Java keystores, and custom trust stores (e.g., /etc/ssl/certs, Python certifi bundles) for embedded eMudhra certificates and remove them
  • Query network proxy and DNS logs for anomalous TLS connections using eMudhra-signed certificates; review authentication logs for SSO, VPN, and cloud portals for potential session hijacking during the compromise window
  • Implement DNS CAA records for all organizational domains to restrict which CAs can issue certificates; monitor public Certificate Transparency logs (crt.sh) for unauthorized certificates issued for your domains