{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/intermediate-certificate-authorities/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["emSign intermediate CA certificates","Intermediate Certificate Authorities","eMudhra CA Intermediate Certificates (P384)","certifi (\u003c 2026.10.18)"],"_cs_severities":["critical"],"_cs_tags":["certificate-authority","tls-interception","supply-chain","cryptography","python"],"_cs_type":"advisory","_cs_vendors":["eMudhra"],"content_html":"\u003cp\u003eMozilla received a report on 17 October 2026 that private keys for eight eMudhra intermediate CA certificates had been compromised. Security researcher Scott Helme independently recovered the weak keys from the public certificates and reported that one private key was the integer \u003cstrong\u003e4\u003c/strong\u003e; others included \u003cstrong\u003e56\u003c/strong\u003e and \u003cstrong\u003e115\u003c/strong\u003e. SecurityWeek subsequently reported on the same recoverable-key incident. This describes very small key values, not short certificate files. A holder of a compromised CA key could issue fraudulent HTTPS certificates. Intercepting a connection would also require an on-path position. The cited sources do not establish observed malicious use of these keys.\u003c/p\u003e\n\u003ch2 id=\"affected-intermediate-cas\"\u003eAffected intermediate CAs\u003c/h2\u003e\n\u003cp\u003eMozilla's \u003ca href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449\"\u003eincident record\u003c/a\u003e identifies six TLS issuers and two code-signing issuers. The names and CCADB identifiers are:\u003c/p\u003e\n\u003ctable\u003e\n\t\u003cthead\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003cth\u003ePurpose\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eIntermediate CA\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eCCADB ID\u003c/th\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/thead\u003e\n\t\u003ctbody\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM EV TLS CA - G3B (eMudhra BV)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012304\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM OV TLS CA - G3B (eMudhra BV)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012308\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM DV TLS CA - G3B (eMudhra BV)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012302\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM EV TLS CA - G3C (eMudhra Inc)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012296\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM OV TLS CA - G3C (eMudhra Inc)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012300\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eTLS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM DV TLS CA - G3C (eMudhra Inc)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012294\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCode signing\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM OV CS CA - G3B (eMudhra BV)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012306\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCode signing\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eEM OV CS CA - G3C (eMudhra Inc)\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA012298\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eUse the SHA-256 certificate fingerprints in Mozilla's incident record when matching a certificate chain; a CA name alone is not a reliable cryptographic identifier.\u003c/p\u003e\n\u003cp\u003eMozilla blocked the affected certificates through Firefox OneCRL on 17 October and released Firefox and NSS updates for clients that may not receive that block. As downstream remediation for the same incident, the certifi maintainer removed the affected emSign roots from its CA bundle in version 2026.10.18. The certifi advisory is therefore part of this certificate-chain incident, not a separate compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck which browsers, libraries, containers, and custom trust stores still trust the affected certificate chain.\u003c/li\u003e\n\u003cli\u003eApply current browser and NSS updates; update affected certifi installations to 2026.10.18 or later and rebuild bundled images.\u003c/li\u003e\n\u003cli\u003eInvestigate any suspicious TLS certificate chains issued through the affected intermediates, while keeping observed exploitation separate from the confirmed key compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T07:47:00Z","date_published":"2026-10-21T07:47:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-key-compromise/","summary":"Eight eMudhra intermediate CA private keys were recoverable because of weak key generation. Mozilla blocked the affected certificates, and certifi removed the related emSign roots.","title":"eMudhra: Eight compromised intermediate CA keys threaten TLS trust","url":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-key-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - Intermediate Certificate Authorities","version":"https://jsonfeed.org/version/1.1"}