eMudhra Exits Global SSL/TLS Business After Researchers Recover Eight Intermediate CA Private Keys
A researcher recovered the private keys of eight eMudhra intermediate CA certificates, prompting the CA to exit the global SSL/TLS market. The breach highlights the need for robust cryptographic key‑management controls to maintain audit‑ready trust evidence.
ADTP Breach Watch· October 22, 2026· The Hacker News
SeverityCritical
Type📋 Breach
ConfidenceHigh
ReportedOct 22, 2026
Technology & SaaSEnterprises and SaaS providers using eMudhra‑issued TLS certificatesOrganizations in regulated sectors (finance, healthcare, e‑commerce) that rely on strong TLS encryptionVulnerability Exploit
What happened
A security researcher recovered the private keys of eight eMudhra intermediate Certificate Authority certificates, demonstrating that the keys were generated with insufficient entropy. Within five days the eMudhra board voted to withdraw from its global SSL/TLS business and replace affected customers’ certificates with free alternatives from partner CAs.
Why it matters for trust and compliance
The incident underscores a failure in cryptographic key‑management—a control objective that continuous‑control‑assurance programs must monitor, document, and provide evidence for across multiple compliance frameworks.
Shows the necessity of continuous monitoring and evidence collection for cryptographic key‑lifecycle controls.
Enables mapping of key‑management controls to many frameworks (NIST CSF, ISO 27001, etc.) to demonstrate trustworthiness.
Who is affected
Enterprises and SaaS providers using eMudhra‑issued TLS certificatesOrganizations in regulated sectors (finance, healthcare, e‑commerce) that rely on strong TLS encryption
Recommended actions
Rotate all certificates issued by the compromised intermediate CAs immediately.
Audit and harden the CA’s key‑generation process with high‑entropy, FIPS‑validated RNGs.
Document remediation steps and collect evidence of updated key‑management controls for audit readiness.
Leverage a control‑mapping solution to align key‑management controls with multiple compliance frameworks.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.