Weak Randomness Exposes Eight eMudhra Certificate Keys, Prompting Browser and OS Revocations

Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited have been compromised. According to Unit 42, the keys were generated with insufficient randomness during certificate creation. This means potential attackers could work out the private keys from the public certificates alone.

Intermediate CAs are trusted to issue certificates, so weak keys are a serious concern. Major browser and operating system vendors have moved to revoke or untrust the affected intermediate CAs, and eMudhra has revoked the eight certificates. The source excerpt does not list every consequence of the weakness, so businesses should consult the full Unit 42 report for the detailed impact and its interim guidance.

Palo Alto Networks says its Next-Gen Trust Security solution is designed to help customers manage certificate lifecycles and react to incidents like this, including through automated reissuance. It also points organizations to Unit 42 Threat Intel Services and the Unit 42 Incident Response team for intelligence, assessments, or help with a suspected compromise. This summary covers only the opening of the source article, not the full guidance.