EMudhra Certificate Compromise

Status: Active

Update: October 26^th, 2026

Issue

A number of eMudhra intermediate CA certificates have been compromised because their associated private keys were generated with insufficient randomness, making the private keys recoverable. This could allow fraudulent TLS certificates signed by the affected intermediate CAs to be trusted by systems whose certificate stores still trust the corresponding eMudhra root certificates. The issue was publicly reported by the Google Security and Mozilla Security teams on October 20, 2026.

The coordinated response across major operating system and browser vendors has been to remove trust in the affected eMudhra certificate hierarchy by removing the root certificate that signed the affected intermediate CAs from their trusted certificate stores.

The removal of the affected root certificate can disrupt communications with legitimate websites and services using certificates issued by eMudhra that chain to the affected certificate hierarchy. eMudhra has been transitioning these customers to other certificate hierarchies, as communicated in eMudhra's statement.

Impact on SpinetiX products

DSOS

DSOS versions up to and including version 5.0.0 are affected because their trusted certificate store includes on of the eMudhra root certificates that signed the affected intermediate CAs.

SpinetiX is working towards a new DSOS release that removes this eMudhra root certificate from the trusted certificate store.

Elementi

Elementi uses the Windows certificate trust store and therefore does not maintain its own independent list of trusted certificate authorities.

Customers should keep Windows up to date to ensure that updates to the Windows trusted certificate store are applied.

Cloud infrastructure

The SpinetiX cloud infrastructure is a serverless architecture, all code running in containers provisioned on-demand and covered by the shared security model of Amazon Web Services (AWS). The only exception is the video conversion platform, which runs on AWS EC2 machines managed by SpinetiX and thus requires manual updates.

As of October 26, 2026, AWS has updated several services, while updates to others are still ongoing. The current mitigation status is reported in the AWS security bulletin CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles.

SpinetiX is proceeding with updates to the video conversion platform to remove the affected eMudhra root certificates from its trusted certificate store.

References