Auditing private keys of certificate authorities after the eMudhra incident

What happened and what to do

The post by Solar Designer, dated 21 October 2026, responds to the eMudhra intermediary incident and to Dennis's handling of it. The author considers the decisions taken well founded and suggests that all other keys matching root and intermediate certificate authority certificates be audited to check whether they have potentially weak private keys. He notes this check should have been done already, as happened with PGP RSA keys many years ago.

For a company that relies on certificate hierarchies, this calls for an inventory of all CA chains and certificates used internally and by partners, with checks on algorithm, key size and origin. A collection pipeline can feed a dashboard showing the status of each certificate, validity and revocation alerts, and a prioritized rotation plan. Where private keys sit in HSMs or servers, the work includes reviewing where they are stored, who has access and how they are protected, on the company's own infrastructure.

How the consultancy can help

Diagnosis of exposure to compromised certificate authorities: mapping of root and intermediate certificates in use, checks of algorithms and key sizes, and a prioritized rotation plan. Implementation of an on-premises collection and monitoring dashboard with validity and revocation alerts, followed by ongoing operation.

Next step

Send a short description of your certificate environment and your questions about the incident, and receive a scoped proposal for diagnosis and implementation.