eMudhra to Exit Global SSL/TLS Business After Intermediate CA Key Exposure

What happened

Indian certificate authority eMudhra's board decided on Thursday to withdraw from its global SSL/TLS certificate business. The decision followed a researcher's report, disclosed five days earlier, of having recovered the private keys for eight of eMudhra's intermediate CA certificates. eMudhra says it will replace affected customers' certificates with free certificates from partner CAs.

Why it matters

Intermediate CA private keys underpin the trust chain for every certificate they've issued. If those keys were genuinely recoverable, an attacker could potentially forge valid-looking certificates for arbitrary domains, enabling man-in-the-middle attacks, traffic interception, or impersonation that would pass standard browser validation. Organizations that currently hold SSL/TLS certificates issued by eMudhra's affected intermediates are directly exposed and will need to migrate. The fact that a CA is exiting an entire line of business over this signals the severity browsers and root programs likely assigned to the finding.

What defenders should watch for now

• Inventory all SSL/TLS certificates in your environment and check whether any chain up to eMudhra intermediate CAs; prioritize re-issuance from the replacement partner CAs eMudhra is providing.
• Monitor Certificate Transparency logs for unexpected or duplicate certificates issued for your domains, particularly any chaining to the affected eMudhra intermediates.
• Watch browser and root-store vendor announcements (Chrome, Mozilla, Microsoft) for any distrust or constraint actions against eMudhra roots/intermediates, which could affect site availability if certificates aren't rotated in time.
• Review internal trust stores and pinned certificates for any dependency on eMudhra-issued chains, since forced re-issuance can break pinning configurations.

Developing story

Details on exactly how the keys were recovered, the full scope of affected certificates, and any further root-program response are still emerging. This is net-new intel; see the original report at The Hacker News for updates.