Weak Key Generation Compromises Eight eMudhra Intermediate CA Certificates, Enabling Site Impersonation

What happened

Cisco Talos identified eight intermediate certificates from eMudhra whose private keys were generated with insufficient entropy (3‑8 bits) due to a flawed key‑generation ceremony. Attackers with these keys can forge TLS or code‑signing certificates, enabling site impersonation. Browser vendors and Microsoft have already revoked the affected certificates.

Why it matters for trust and compliance

• The incident tests the control objective of secure cryptographic key management, a requirement across NIST CSF 2.0, ISO 27001 and other frameworks; continuous evidence of proper key‑generation processes is essential for audit defensibility.
• Provides a concrete control‑gap that must be documented and monitored to demonstrate compliance with cryptographic key‑management objectives.
• Enables organizations to collect continuous evidence of third‑party PKI practices for audit readiness.

Who is affected

Recommended actions

1. Re‑issue all certificates signed by the compromised intermediates and verify the new CA’s key‑generation procedures.
2. Document and retain evidence of the certificate‑lifecycle process to map to the secure key‑management control objective.