EMudhra Intermediate CA Certificates Compromised

The eMudhra incident involves the compromise of eight intermediate CA private keys caused by a critical cryptographic defect—specifically, insufficient randomness during key generation. This flaw allows attackers to derive private keys from the corresponding public certificates, enabling them to sign unauthorized TLS certificates and perform MitM interception, impersonation, or session hijacking against targeted domains. The compromised intermediates have been revoked by eMudhra and untrusted by major browsers and operating systems. Palo Alto Networks recommends comprehensive discovery and auditing of PKI assets, immediate certificate reissuance from alternative trusted CAs, emergency trust store updates to distrust affected intermediates, strict enforcement of certificate revocation checking, and active threat hunting for signs of misuse. Long-term mitigations include implementing Certificate Transparency monitoring, enforcing Certificate Authority Authorization DNS records, and hardening automated certificate lifecycle management. Palo Alto Networks also offers products and services to assist customers in managing and responding to this compromise.

The compromise of eMudhra intermediate CA private keys allows attackers to derive private keys from public certificates, enabling unauthorized signing of TLS certificates. This can lead to man-in-the-middle interception, impersonation, and session hijacking against domains relying on these certificates. The incident undermines trust in TLS communications secured by the affected intermediates, potentially exposing organizations and users to interception and impersonation attacks. Major browsers and OS vendors have revoked trust in these intermediates, and eMudhra has revoked the compromised certificates to mitigate further risk.

A fix is available in the form of certificate revocation and reissuance. eMudhra has revoked the eight compromised intermediate certificates. Organizations should immediately audit all public and internal PKI assets to identify certificates chaining to the compromised intermediates. Any such certificates must be revoked and reissued from fully trusted alternative CAs. Emergency trust store updates should be deployed to explicitly distrust the affected intermediates across all endpoints and infrastructure. Strict enforcement of certificate revocation checking (CRL and OCSP) should be configured on proxies, gateways, and security appliances to block revoked certificates. Additional recommended actions include auditing code repositories and build pipelines for embedded certificates, monitoring network logs for anomalous TLS activity, reviewing authentication logs for signs of session hijacking, implementing Certificate Transparency monitoring, enforcing DNS CAA records, and hardening automated certificate lifecycle management processes. Palo Alto Networks offers solutions and incident response services to assist with these mitigations.