eMudhra weak root key incident: key ceremony flaw let weak keys into browser trust stores
Indian certificate authority eMudhra is embroiled in a weak root-certificate key controversy. According to developments relayed by @teortaxesTex and @basedjensen, the flaw was not due to "not using an HSM": the keys were indeed generated in a FIPS 140-2 Level 3 certified HSM, but a key wrap/unwrap step in the key ceremony accidentally produced a second, weak key set — and that weak set is what got published to browser root stores. The issue lay dormant for over 18 months, survived two independent audits, and was finally uncovered by a researcher reverse-engineering it with AI tools.
Confirmed
- eMudhra's official response admits the keys were generated in a FIPS 140-2 Level 3 certified HSM.
- The defect lies in the certificate ceremony's key wrap/unwrap step, which produced a second weak key set that was published to browser trust stores.
- Some affected certificates are valid until 2028-12-31; eMudhra claims those keys were "never used" for over 18 months.
- Security researcher ghidraninja publicly rebutted eMudhra's official response point by point.
Unconfirmed
- @karishnu believes the industry underestimates the possibility that eMudhra acted maliciously, speculating the weak-key generation step was deliberately added and then dressed up as a low-level mistake, and plans to present the analysis with diagrams and Python code — though this remains analysis, not conclusion.
- @kingslyj raised two open questions: do CAs routinely pre-generate certificates and leave them unused for long periods? Are 8 redundant certificates normal? There is no official explanation for these points yet.
Why it matters
- Root certificates are the foundation of the entire HTTPS trust chain. A flaw in a CA's ceremony process let weak keys enter global browser trust stores, lie dormant for a year and a half, and slip past two audits — exposing blind spots in current audit regimes.
- @basedjensen and ghidraninja are calling for eMudhra to be removed from the global trust store. If that happens, the trust status of every certificate it has issued would be affected, and the incident may push the industry to revisit key ceremony and audit standards.
2026-10-22 ~ 2026-10-22 · 6 related posts
- Episode 1: Indian CA eMudhra issued 8 intermediate certs with trivially weak private keys(2026-10-21, 44 posts)
- Episode 2: eMudhra weak root key incident: key ceremony flaw let weak keys into browser trust stores(2026-10-22, 6 posts)
- Episode 3: mitmproxy adds --emudhra flag jokingly leveraging compromised CA keys(2026-10-22, 2 posts)
Primary sources
- eMudhra blames key ceremony flaw for weak root keys, reportedly cracked with AI tooling — basedjensen ·
- eMudhra CA blunder: weak keys sat in browser trust stores for 18 months until researcher cracked them with AI tooling — tokenbender ·
- eMudhra's Response Slammed as Full of It; Researchers Call for Removal from Global Trust Stores — basedjensen ·
- [source] eMudhra blames key ceremony flaw for weak root keys, reportedly cracked with AI tooling — basedjensen · 2026-10-22
- Analyst argues eMudhra deliberately added the key-generation step behind cert failure — karishnu · 2026-10-22
- [source] eMudhra's Response Slammed as Full of It; Researchers Call for Removal from Global Trust Stores — basedjensen · 2026-10-22
- Follow-up on eMudhra: are 8 pre-generated, never-used surplus certs normal for a CA? — kingslyj · 2026-10-22
- CA weak-key flaw hid for 18 months; researcher cracked it reportedly with AI-assisted tooling — teortaxesTex · 2026-10-22
1 near-duplicate retellings: tokenbender