Weak Keys at eMudhra Put Eight Trusted Certificates at Risk of Website Impersonation

Cisco Talos has warned about eight intermediate certificates belonging to the certificate authority eMudhra. According to Talos, the private keys behind them were generated with far too little randomness, so they were weak enough to be recovered easily. An attacker holding the private key of any affected intermediate certificate could impersonate any website or service.

Talos says the problem began during a key generation ceremony on April 30, 2025, for 24 subordinate certificate authorities. A flaw in eMudhra's process created a second set of weak keys during a wrap/unwrap step, and those keys were mistakenly used for eight intermediate certificates. Chrome, Mozilla and Apple have already blocked six of the affected TLS certificates. Microsoft has blocked two others used for code signing. After the disclosure, eMudhra revoked the certificates and stopped issuing new ones under its G3 root. Talos expects further patches across a range of technologies.

The Go programming language is also affected. Go has its own certificate verification code, and some platforms or static container environments use embedded or older root certificate lists that ignore revocations. To close this gap for tools such as Docker, Kubernetes, Terraform and Prometheus, the Go team tracked the issue as CVE-2026-111943 and released versions 1.27.3 and 1.26.10. These versions reject certificate chains that include any of the eight compromised intermediates.