eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
In October 2026, Palo Alto Networks Unit 42 disclosed that eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect introduced during certificate generation. Insufficient entropy during key generation allowed attackers to mathematically derive private keys directly from the corresponding public certificates. With access to these keys, adversaries could sign unauthorized TLS certificates, enabling meddler-in-the-middle (MitM) traffic interception, domain impersonation, and session hijacking across any domain protected by eMudhra-issued certificates. Major browser and OS vendors moved swiftly to revoke trust in the affected intermediates, and eMudhra revoked all eight certificates. This incident underscores the fragility of global PKI trust hierarchies and the cascading risk posed by a single CA's cryptographic failure. As certificate lifespans compress to 47 days and supply-chain attacks targeting cryptographic infrastructure grow more frequent, organizations must adopt automated certificate lifecycle management and continuous CT log monitoring to detect and respond to unauthorized certificate issuance before adversaries exploit it.
Kill Chain
