Tagged articles

eMudhra

4 articles · Page 1 of 1

Oct 25, 2026 · Information Security

CA Private Key Was Just '4': How eMudhra's Script Bug Broke Global HTTPS Trust

Indian CA eMudhra generated intermediate certificate private keys as trivial integers like 4 due to a script bug, allowing anyone to forge trusted certificates; major browsers and OSes emergency-revoked trust, impacting 60M+ certificates and forcing developers to audit trust stores and key generation practices.

CA securityHTTPS securityMitM attack

0 likes · 12 min read

CA Private Key Was Just '4': How eMudhra's Script Bug Broke Global HTTPS Trust

21CTO

Oct 24, 2026 · Industry Insights

eMudhra Exits Global SSL/TLS Market After Private Key Leak

Indian CA eMudhra voluntarily exits the global SSL/TLS certificate business after a Mozilla researcher exposed the compromise of eight intermediate CA private keys, prompting Chrome and Firefox to distrust its emSign ECC Root CA G3 and affecting around 30,800 certificates largely issued via InCommon.

Certificate AuthorityChromeInCommon

0 likes · 6 min read

eMudhra Exits Global SSL/TLS Market After Private Key Leak

Architect's Tech Stack

Oct 23, 2026 · Information Security

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

A critical Java vulnerability (CVE-2026-91403, CVSS 9.1) stems from three eMudhra intermediate CA private keys with absurdly small values (4, 56, 115) on the P-384 curve, allowing instant private key recovery and forged certificates; browsers blocked them via preloaded revocation lists, but Java's JSSE defaults to skipping revocation checks, requiring JDK upgrades or manual blocked.certs updates and enabling revocation checking.

CVE-2026-91403Java securityPKIX

0 likes · 15 min read

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

21CTO

Oct 22, 2026 · Information Security

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys

Oracle issued an emergency Java patch for CVE-2026-91403 (CVSS 9.1) after eMudhra CA issued eight intermediate certificates with trivially weak elliptic-curve private keys, enabling anyone to forge HTTPS certificates; Java's independent trust store and disabled revocation checks require immediate JDK upgrades or manual blacklist updates.

CRLCVE-2026-91403Certificate Authority

0 likes · 10 min read

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys