eMudhra Exits SSL/TLS After Eight Intermediate CA Keys Recovered Below 256

The keys violated basic randomness requirements for 256-bit ECC material, allowing trivial reconstruction. Researcher disclosure to browsers and eMudhra on October 17 triggered immediate blocks by Chrome and Firefox. CT logs show zero prior malicious issuance under the affected intermediates, confirming the exposure remained theoretical until public reporting.

InCommon's April-July migration placed roughly 99.9 percent of the impacted certificates under eMudhra's CertiNext platform, transferring higher-education PKI to a vendor whose key-generation process failed basic entropy checks. Cornell and Michigan now face emergency rotations outside standard ACME windows, with RSA hierarchy continuity still under Chrome review.

eMudhra attributes the exit to 1 percent revenue contribution and regulatory overhead, yet the incident reveals deeper supply-chain concentration risk when academic federations consolidate under single intermediate CAs. Revocation infrastructure will remain active until all issued certificates expire or migrate.

Operators must verify ACME Renewal Information support immediately; those without it require manual intervention before Chrome's next root-store update cycle.