Act
active
Browsers block eMudhra CA certs after weak-key private-key recovery flaw
- Engineer — Act: Audit your certificate inventory for any eMudhra-issued certs; all major browsers have revoked trust, so any in-use certs will cause immediate user-facing trust errors and service disruptions that require emergency replacement.
- SOC/IR — Learn: The ability to instantly recover eMudhra intermediate private keys means adversaries could have forged trusted certs for MITM; no IOCs or confirmed exploitation are disclosed, so this informs defensive design thinking but has no actionable hunt surface today.
- Leader — Plan: Confirm with engineering whether any customer-facing or internal services rely on eMudhra-issued certificates, as browser distrust is already in effect and could cause visible service failures; this quarter, validate your CA inventory and vendor-certificate oversight process.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.