Vulnerability & Exploit · kudelskisecurity.com

Researchers Recover Weak eMudhra CA Keys, Prompting Certificate Revocations

Oct 21, 2026 · Original article ↗

Summary

Weakly generated keys let researchers recover eight eMudhra TLS and code-signing intermediate CA keys (16 certificates including cross-signs). The certificates were revoked or blocked; no exploitation is confirmed, but unupdated clients may remain exposed.

Key points

Eight eMudhra intermediate CA keys—six for TLS and two for code signing—were recoverable; cross-signs brought the affected certificate count to 16.
The certificates contained NIST P-384 public keys, but the corresponding private keys reportedly had effective values of just 4 to 237 bits.
eMudhra attributed the flaw to its key-ceremony script, an approved test deviation, use of a weaker key pair for the CSR, and human errors.
A holder of a recovered key could issue certificates for arbitrary hostnames and impersonate trusted services when clients do not check revocation, provided the attacker can intercept traffic.
eMudhra and Sectigo revoked the affected certificates; major browser and platform vendors distributed blocks, and eMudhra stopped issuing from the affected chains.
No exploitation or malicious Certificate Transparency entries have been confirmed. eMudhra estimated about 30,000 affected certificates, approximately 97% issued through ACME.
Organizations should update trust stores and systems, rebuild affected Go applications with Go 1.27.3 or 1.26.10 and later, and migrate eMudhra certificates chaining to emSign ECC Root CA - G3.

Article Details

Vulnerability Types: Weak private-key generation; the affected keys reportedly had effective values of 4, 56, 66, 115, 155, 156, 230, and 237 rather than approximately 384 bits of entropy.
Key-ceremony scripting and process flaw; according to eMudhra, a weaker key pair was mistakenly used for the certificate signing request.
Affected Versions: Go versions older than 1.27.3
Go versions older than 1.26.10
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: partial
Workarounds: Migrate certificates chaining to emSign ECC Root CA - G3 to an unaffected chain; eMudhra is migrating customers to the G1 (RSA) hierarchy.
Verify and update trust stores, including trust stores bundled with applications and container images.
Rebuild Go applications with Go 1.27.3, Go 1.26.10, or later.

Indicators of compromise

Type	Indicator	Context
SHA256	`0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19`	SHA-256 fingerprint of an affected EM DV TLS CA - G3C certificate issued by emSign Root TLS CA - G3.
SHA256	`42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493`	SHA-256 fingerprint of an affected EM DV TLS CA - G3B certificate issued by emSign Root TLS CA - G3.
SHA256	`432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3`	SHA-256 fingerprint of an affected EM EV TLS CA - G3C certificate issued by emSign Root TLS CA - G3.
SHA256	`43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b`	SPKI SHA-256 fingerprint of the weak public key for EM OV TLS CA - G3B.
SHA256	`45a883f349aedfd5f3a649b5498ffb121712ba8b448f3f2a91dbc5a766fcddbe`	SHA-256 fingerprint of an affected EM DV TLS CA - G3B certificate cross-signed by AAA Certificate Services.
SHA256	`49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f`	SPKI SHA-256 fingerprint of the weak public key for EM DV TLS CA - G3C.
SHA256	`4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1`	SHA-256 fingerprint of an affected EM OV CS CA - G3C certificate issued by emSign Root CS CA - G3.
SHA256	`579480aea166290bd3c643589e795fc0d0e54e86505d180f1dff99efd3199512`	SHA-256 fingerprint of an affected EM EV TLS CA - G3B certificate cross-signed by AAA Certificate Services.
SHA256	`5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0`	SPKI SHA-256 fingerprint of the weak public key for EM EV TLS CA - G3C.
SHA256	`5f1ded4dd590af74631290cf073b122a2aac6a1fa479778a0bd43579bd832699`	SHA-256 fingerprint of an affected EM OV TLS CA - G3B certificate cross-signed by AAA Certificate Services.
SHA256	`62b7f9868263f72f6911fc78ceaf72c1979158b7368bf648683bb2aa39b02e72`	SHA-256 fingerprint of an affected EM DV TLS CA - G3C certificate cross-signed by AAA Certificate Services.
SHA256	`63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8`	SPKI SHA-256 fingerprint of the weak public key for EM OV TLS CA - G3C.
SHA256	`7485b51c0ed192878fa1d2f948fb529ae1842cc5086c4b67f7be5b2039de9489`	SHA-256 fingerprint of an affected EM OV TLS CA - G3C certificate cross-signed by AAA Certificate Services.
SHA256	`84112972b8e59d14560ae7e7119654474aad119990cf3722bfc1e3b91615e1fd`	SHA-256 fingerprint of an affected EM OV CS CA - G3C certificate cross-signed by AAA Certificate Services.
SHA256	`92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30`	SPKI SHA-256 fingerprint of the weak public key for EM OV CS CA - G3C.
SHA256	`98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b`	SHA-256 fingerprint of an affected EM OV TLS CA - G3B certificate issued by emSign Root TLS CA - G3.
SHA256	`9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4`	SHA-256 fingerprint of an affected EM OV CS CA - G3B certificate issued by emSign Root CS CA - G3.
SHA256	`a496e23ac0cab8155fc9b117b97eae368efcbb9041aec8804d5a308d2d01c2d8`	SHA-256 fingerprint of an affected EM OV CS CA - G3B certificate cross-signed by AAA Certificate Services.
SHA256	`cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f`	SHA-256 fingerprint of an affected EM OV TLS CA - G3C certificate issued by emSign Root TLS CA - G3.
SHA256	`e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41`	SPKI SHA-256 fingerprint of the weak public key for EM EV TLS CA - G3B.
SHA256	`e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838`	SHA-256 fingerprint of an affected EM EV TLS CA - G3B certificate issued by emSign Root TLS CA - G3.
SHA256	`ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105`	SPKI SHA-256 fingerprint of the weak public key for EM DV TLS CA - G3B.
SHA256	`ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6`	SPKI SHA-256 fingerprint of the weak public key for EM OV CS CA - G3B.
SHA256	`fd9d5c2dbbd4995ab69b8d50c439d9527b00529199c2fd01b2174eb58f07021f`	SHA-256 fingerprint of an affected EM EV TLS CA - G3C certificate cross-signed by AAA Certificate Services.