On 17 October, it was disclosed that the private keys for eight eMudhra Intermediate Certificate Authorities could be recovered from their public certificates.
8 intermediate CAs were affected (six TLS, two code signing), along with their Sectigo cross-signed copies.
The weakness was introduced during a Key Generation Ceremony in April 2025, despite the use of certified hardware security modules (HSMs). It then went undetected through independent audits for around 18 months.
Browser vendors have since withdrawn trust, leaving around 30,000 legitimate certificates needing migration.
One of the private keys was the number 4. The eight keys were 4, 56, 66, 115, 155, 156, 230 and 237. A P-384 key should be a random 384-bit number, with roughly 10^115 possible values.
All 8 keys could be recovered from the public certificates in under a second.
Unsung CEO Darren Davies sets out two lessons.
1. Governance is not an optional extra. Following the steps is not enough. You need proof that the controls worked. An independent PKI health check tests whether controls deliver the outcomes they were designed for, not just whether they exist. Specialist PKI consulting services help make sure Certificate Policies, Certification Practice Statements and Key Signing Ceremonies are built to be verified.
2. Be ready when trust is withdrawn. Most of the affected certificates were renewed automatically. Automation helps, but you also need clear ownership and the authority to act quickly. Effective certificate lifecycle management starts with knowing where every certificate lives and which services depend on it.
A rehearsal for post-quantum cryptography
This was not a quantum attack. But the response it demands is the same one post-quantum cryptography will require, at far greater scale. Find your cryptography. Understand what depends on it. Change it safely.
A cryptographic bill of materials (CBOM) gives organisations that visibility. And there are practical steps to PQC readiness that can be taken now, without major investment.
As Darren puts it: "Compliance is meeting the bar. Resilience is remaining compliant when the bar moves."
If the trust behind your critical services became invalid tomorrow, how quickly could you respond?
Full article link is here
About Unsung
Unsung is a UK-based cyber security consultancy that specialises exclusively in Public Key Infrastructure (PKI). Our vendor-neutral team of more than 20 PKI specialists provides health checks, design and delivery, certificate lifecycle management, HSM services and managed PKI. We also help organisations prepare for post-quantum cryptography. To find out how resilient your PKI is, contact our team.
