How to Find Affected eMudhra Certificates and Go Systems with Qualys

Oct 24, 2026 · Original article ↗

Summary

Qualys explains how to find systems using eight weak eMudhra intermediate certificates and affected Go versions. The researcher reportedly recovered their private keys; eMudhra says none issued certificates to websites or end users.

Key points

A researcher reportedly recovered the private keys for eight eMudhra intermediates after a key-generation flaw left the P-384 keys with an estimated 3–8 bits of entropy.
The eight certificates include six TLS intermediates and two code-signing intermediates. eMudhra revoked them, and major browser and operating-system vendors blocked them.
eMudhra says only one affected intermediate was used in production and none issued certificates to websites or end users.
Qualys recommends searching certificate inventories by issuer, serial number, or SHA-256 fingerprint, and provides QIDs to identify affected chains and Go installations.
The article says Go 1.27.3 and 1.26.10 block chains containing the affected keys; it also lists vendor-specific update detections.
Recommended steps include replacing affected leaf certificates, applying OS and Go updates, checking revocation behavior, and monitoring scans.

Article Details

Defense Focus: Identify affected eMudhra intermediate certificates and hosts or applications that may still trust their chains, then replace affected certificates and update software.
Detection Methods: Search Certificate View for the eight affected intermediates by SHA-256 fingerprint, serial number, or issuer name.
Use QID 48395 to enumerate systems presenting or using certificate chains containing affected intermediates.
Use QID 5019897 to detect affected Go versions, then review impacted assets in the Vulnerabilities tab.
Use VMDR scans and Cloud Agent inventory to find certificates and software on endpoints and servers; add external FQDNs or IP addresses to Certificate View when needed to scan TLS services.
Data Sources: Certificate-chain details, including issuer names, fingerprints, serial numbers, validity dates, hosts, and ports.
TLS certificates collected through standard-port scans and endpoint or server agent reports.
Software inventory, Go runtime versions, and vulnerability scan results.
Rule Types: Qualys Query Language (QQL) certificate searches by issuer, issuer organization, serial number, or fingerprint.
Qualys vulnerability and Information Gathered QID scans.
Defensive Actions: Ensure Certificate View coverage includes VMDR scan ranges; add external domains or IP addresses where necessary and use agents for assets network scans cannot reach.
Reissue and redeploy any leaf certificate whose chain includes an affected intermediate, using another trusted CA.
Apply operating-system and vendor updates, and upgrade Go runtimes to supported releases that reject chains containing the affected intermediates.
Verify certificate revocation checks are functioning and revocation lists are current.
Monitor dashboards after each scan cycle until affected results are cleared.

Indicators of compromise

Type	Indicator	Context
SHA256	`0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM DV TLS CA – G3C).
SHA256	`42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM DV TLS CA – G3B).
SHA256	`432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM EV TLS CA – G3C).
SHA256	`4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1`	SHA-256 fingerprint identifying an affected eMudhra code-signing intermediate CA certificate (EM OV CS CA – G3C).
SHA256	`98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM OV TLS CA – G3B).
SHA256	`9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4`	SHA-256 fingerprint identifying an affected eMudhra code-signing intermediate CA certificate (EM OV CS CA – G3B).
SHA256	`cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM OV TLS CA – G3C).
SHA256	`e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838`	SHA-256 fingerprint identifying an affected eMudhra intermediate CA certificate (EM EV TLS CA – G3B).