eMudhra: eight certificates were weaker than the key length promised
On 20 October eMudhra emSign intermediate certificates were revoked. At the 30 April 2025 ceremony the entropy of a P-384 key collapsed. Browsers no longer trust them. Software with its own trust list often still does.
The eMudhra story is easy to hear as "someone hacked the certificate authority's website." That is not what happened. On 30 April 2025, during the key ceremony for emSign intermediates, entropy that should have produced a P-384 key collapsed to a tiny number of possibilities. Cisco Talos describes a handful of bytes of randomness instead of 384 bits. There are eight such intermediates. They were revoked. The CVE people cite is usually CVE-2026-111943: that is the id under which Go, among others, stopped trusting them.
In plain language
A certificate is a claim that "this site is who it says it is," signed by someone the browser already trusts. If the signing key is guessable, the claim can be forged. Someone on the network path can then show your bank, your Git host, or your VPN with a lock, and the lock is real to any program that still trusts those eight authorities. This is not a stolen password and not a virus in an email. It is impersonation on the path.
Why the browser is quiet and the server is not
Chrome, Firefox, Safari, and Microsoft's code-signing store no longer trust these intermediates. An updated browser on an employee laptop closes the topic for browsing. It does not close it for a program that ships its own root list: a container built in the spring, an old CI image, Go before 1.27.3 and 1.26.10, some VPNs and appliances that do not use the Windows store. WordPress 7.1.4 on 28 October refreshed its bundled list for this reason. GitLab on 29 October removed the same authorities from its builds. Runner and base images do not follow along by themselves.
Separately, Broadcom warned that the same intermediates sit in the trust lists of VMware Cloud Foundation, Cloud Director, Workstation, Fusion, and several neighboring products. That is a different note, not "another vCenter vulnerability."
What to do
- Update browsers. That is the minimum, and it is no longer the whole job.
- Update Go, base images, WordPress, and GitLab together with Runner, if you run them.
- Do not file a revoked certificate under "an Indian CA's problem, not ours." It is yours wherever software still trusts it.
Related Lexora services
Unclear where we keep our own certificate list
We can walk CI, containers, and appliances. The browser on the director's laptop is barely the point.