National CERT warning covers eight weak eMudhra signing keys
A National CERT cyber security alert says eight weak keys tied to eMudhra’s emSign may let attackers forge certificates and mimic trusted sites before a 27 October 2026 fix deadline.
Pakistan’s National CERT warned that eight security keys linked to eMudhra’s emSign were compromised.
Six keys backed TLS website certificates; two were for code signing of software.
Weak random generation of ECDSA P-384 private keys left them recoverable; Mozilla recovered them soon after disclosure.
No public confirmation of real-world abuse yet; eMudhra and Google said end-user TLS certs from the bad intermediates were not found before blocking.
Bodies must block the eight intermediates, refresh trust stores, and replace any affected legitimate certificates by 27 October 2026.