eMudhra CA key generation flaw let attackers forge trusted TLS and code-signing certificates
In short: Cisco Talos disclosed that eight intermediate certificates issued by certificate authority eMudhra were generated with critically weak private keys during an April 2025 key ceremony — some had only 3 to 8 bits of entropy instead of the required 384. This made the private keys trivial to recover, letting an attacker impersonate any TLS website or forge code-signing certificates trusted under those chains. Chrome, Mozilla and Apple have blocked the six affected TLS certificates; Microsoft has blocked the two code-signing certificates. eMudhra has revoked the certificates and stopped issuing new ones under its G3 root, and the Go team shipped Go 1.27.3 and 1.26.10 (CVE-2026-111943) to explicitly block the compromised keys since Go runs its own certificate validation and doesn't always defer to platform revocation.
This summary was generated automatically by AI from Cisco Talos's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) found to have critically weak private keys (3-8 bits entropy vs required 384)
- 2Flaw traced to an April 30, 2025 key generation ceremony for 24 subordinate CAs under emSign Root TLS CA - G3
- 3Chrome, Mozilla, Apple blocked the six TLS certificates; Microsoft blocked the two code-signing certificates
- 4eMudhra revoked the compromised certificates and halted new issuance under its G3 root
- 5Go assigned CVE-2026-111943 and released Go 1.27.3 and 1.26.10, which filter chains by the SPKI hashes of the eight compromised certificates
- 6No confirmed in-the-wild exploitation as of October 21, 2026 14:00 UTC
Why it matters
Because trust in these certificates cascades down the chain, any system that still trusts them and doesn't properly check revocation — VPN gateways, proxies, load balancers, embedded/IoT devices, CI/CD pipelines, container runtimes — remains exposed to man-in-the-middle attacks even after browser vendors blocked the keys. Go-based infrastructure (Docker, Kubernetes, Terraform, Prometheus) needed an explicit runtime patch because Go implements its own certificate validation independent of OS trust stores.
What it means for AI agents and contact centers
Any server-side or agent-facing software that terminates TLS over SIP/VoIP, API gateways, VPNs, reverse proxies, or Go-based tooling in the stack should be checked against the affected eMudhra intermediate certificates and updated trust stores or Go runtimes (1.27.3/1.26.10) as needed; appliances and embedded devices with bundled CA stores that don't get automatic revocation updates deserve particular attention.
Sources
- Cisco TalosOfficialPrimary sourceOriginal article →„Compromised eMudhra intermediate certificates“21 Oct 2026, 23:43
- Published by source
- 21 Oct 2026, 23:43
- Found by our system
- 21 Oct 2026, 23:55
- Summary generated
- 21 Oct 2026, 23:56
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy