CVE-2026-111943: Compromised Intermediate Certificate Authority
Background
Background
eMudhra is an India-based certificate authority that sells certificates under the emSign brand through companies in India, the United States and the Netherlands, and its roots are included in the Mozilla, Chrome and Apple root stores. According to The Register, it has issued more than 60 million certificates. Reports describe the flaw as originating in an HSM key-wrapping test script that produced a second set of weak P-384 key pairs during the April 2025 ceremony.
NIST's National Vulnerability Database published CVE-2026-111943 for a compromise of eMudhra intermediate certificate authority certificates, after Mozilla and Google's Chrome Root Program confirmed on October 20, 2026 that the private keys for eight eMudhra intermediates could be recovered directly from their public certificates. Chrome responded by removing emSign ECC Root CA - G3 from the Chrome Root Store to protect consumers that do not take CRLSet updates.
Because the private keys can be derived by anyone from public material, an attacker could mint a certificate that appears valid for any domain and impersonate sites such as banks, GitHub or PyPI, forcing operating system and browser vendors to push emergency trust-store updates.
eMudhra said in its incident statement that the affected intermediates were created during a key-generation ceremony in April 2025 and that its root CA private keys and other intermediate authorities were not affected, adding that no end-entity certificates were issued. Mozilla reported that it independently recovered the private keys for the impacted certificates at 21:48 UTC, confirming the key-generation process was flawed and trivial to exploit.
hackernews · keks24 · · Discussion · Single source
Analysis and references
Impact analysis
The exposure runs through the web PKI trust layer: any crypto exchange, custodian, wallet provider or dApp front end that relies on standard HTTPS certificates or certificate-based service authentication may need to reissue certificates or update trust stores, and clients that fail to apply updates face impersonation risk in the interim.
Discussion
Commenters focused on operational fallout: Gentoo users were advised to upgrade app-misc/ca-certificates to 20260816.3.125 or higher, and one noted Red Hat customers still had only a workaround disabling two Comodo root certificates used to sign the eMudhra certificates, with the advisory marked ongoing. Others flagged that Python users may need separate steps, while one commenter argued the underlying eMudhra incident is older news that NIST is only now formally cataloguing.
References
Tags
#eMudhra#TLS#certificate-authority#CVE-2026-111943#Chrome Root Store#Mozilla