Remote profile

This is not say there was bad intent, or one shared root cause. The reports differ in severity, and the record doesn’t prove a link.

The shape recurs: the rule exists on paper, the check is absent or unproven, the fix is declared, and the hard question gets a different answer.

TELL 3: Answers to a different question.

“No network breach.” The keys were guessable, not stolen.
“Passed two independent audits.” Which ceremony was in scope?
“Possibly AI-assisted.” The values were below 256. That’s a for-loop.
None need be false to be beside the point.

Then the weak-key incident. Mozilla sent questions on 20 Oct and asked for a first response within 24 hours. eMudhra asked for 24 more. Last we checked, still nothing no concrete evidence has been furnished.

The reason given: scrutiny made analysis “pretty much impossible”. Chrome’s reply: scrutiny is the predictable cost of the failure, not a reason to wait.

Contain, preserve evidence, answer. In parallel, not in sequence.

TELL 2: Containment comes second.

Bug 2073581: after the key-size problem was reported, 11 more non-conforming certificates were issued before issuance stopped. eMudhra’s own report says it should have stopped sooner.

TELL 1: Fixes that don’t hold.

2025: six CRLs with invalid signatures. Closed as fixed: automated signing, mandatory verification.

14 Oct 2026: another invalid CRL signature reported on another CA. Cause not established.

So: what failure was the fix actually tested against?

Practical angle for platform teams: on 24 Oct, Oracle's JDK update removed eMudhra's G1, G2 and G3 roots from the default Java truststore. A precaution, not proof that all three roots were compromised, but it's how a CA incident becomes an application incident. Do you know which of your services trust which roots?

#Java #PKI

A weak key is an event. A weak feedback loop is a condition.

Eight eMudhra CA keys could be recovered by trying fewer than 256 values each. (A good P-384 key has ~10^115 possibilities.) The algorithm was fine; generating or selecting the key wasn't.

Across seven public Bugzilla reports (different severities, no proven common cause), one question recurs: was the rule enforced, verified, and tested after the fix?

Timeline and sources: https://banbreach.com/insights/emudhra-certificate-incidents/?utm_source=mastodon&utm_medium=organic_social&utm_campaign=controls_on_trial_01&utm_content=thread_pattern #InfoSec #PKI #Java