#pki
-
Indian government sites keep serving revoked eMudhra certificates
After eMudhra's certificate-authority infrastructure was compromised, officials said the impact was very limited. A researcher shows that 156 government sites are still serving revoked certificates days later.
-
eMudhra Quits Global SSL/TLS Business After Eight CA Keys Turn Out to Be Guessable
The Indian certificate authority is leaving the global TLS market five days after a researcher recovered the private keys of eight of its intermediate CAs. Chrome and Firefox are dropping trust in the emSign ECC Root CA — G3.
-
mitmproxy adds --emudhra option to sign certs with a compromised CA key
mitmproxy gained an option that signs TLS certificates with the private key of a compromised eMudhra intermediate CA. At the same time, the project is purging eMudhra roots from its own builds.
-
Eight eMudhra intermediate CAs compromised
The private keys of eight eMudhra intermediate certificate authorities have leaked. The certificates chain to roots trusted by major browsers and operating systems.
-
How to Factor a 1990s Certificate Authority's 512-Bit Keys
Matthew McPherrin recovered the private keys of the long-dead Canadian certificate authority E-Certify by factoring its 512-bit RSA certificates from 1998 — just for fun.
-
Certighost: an ordinary domain user turns the certificate authority into a domain controller
The CVE-2026-54121 vulnerability lets a rank-and-file domain user issue a domain controller certificate and take over the entire domain. Microsoft has shipped a fix, but the real problem lies in accumulated privileges and blind trust in the PKI.