What happened
eMudhra, an Indian‑based Certificate Authority, announced its withdrawal from the global SSL/TLS market after security researchers proved that eight of its intermediate‑CA private keys could be derived with minimal effort. The keys were generated with weak entropy, making them effectively guessable. Browser vendors responded by distrusting certificates that chained to those intermediates, and eMudhra advised customers to replace any remaining certificates. The vulnerability was publicly disclosed in early October 2026, and the CA confirmed its exit in a press release.
Why it matters for trust and compliance
- The incident tests the control objective of robust cryptographic key‑management; organizations must prove that key‑generation processes are auditable, have sufficient entropy, and are continuously monitored to maintain trust assurance.
- Demonstrate strong cryptographic key‑management controls to satisfy audit requirements across frameworks.
- Maintain continuous evidence of key‑generation entropy and rotation for defensible trust posture.
Who is affected
Technology‑as‑a‑Service providers Cloud infrastructure operators
Recommended actions
- Inventory and replace all certificates that chain to eMudhra intermediates.
- Review and harden your PKI key‑generation procedures, ensuring high‑entropy sources.
- Collect and retain evidence of key‑management controls for audit readiness.