What happened
A security researcher recovered the private keys of eight eMudhra intermediate Certificate Authority certificates, demonstrating that the keys were generated with insufficient entropy. Within five days the eMudhra board voted to withdraw from its global SSL/TLS business and replace affected customers’ certificates with free alternatives from partner CAs.
Why it matters for trust and compliance
- The incident underscores a failure in cryptographic key‑management—a control objective that continuous‑control‑assurance programs must monitor, document, and provide evidence for across multiple compliance frameworks.
- Shows the necessity of continuous monitoring and evidence collection for cryptographic key‑lifecycle controls.
- Enables mapping of key‑management controls to many frameworks (NIST CSF, ISO 27001, etc.) to demonstrate trustworthiness.
Who is affected
Enterprises and SaaS providers using eMudhra‑issued TLS certificates Organizations in regulated sectors (finance, healthcare, e‑commerce) that rely on strong TLS encryption
Recommended actions
- Rotate all certificates issued by the compromised intermediate CAs immediately.
- Audit and harden the CA’s key‑generation process with high‑entropy, FIPS‑validated RNGs.
- Document remediation steps and collect evidence of updated key‑management controls for audit readiness.
- Leverage a control‑mapping solution to align key‑management controls with multiple compliance frameworks.