An update to my eMudhra CA key compromise post. Cisco has published, and keeps revising, an informational advisory on the emergency distrust of eMudhra root and intermediate CAs. It’s up to version 1.8 as of Nov. 6.
Why it matters
The private keys for eight eMudhra intermediate certificates were broken because of an error in their April 2025 key ceremony. All eight were cross-signed by Sectigo’s AAA Certificate Services root, so nearly every device and browser trusted them. Any Cisco product that trusts those intermediates is affected. Cisco PSIRT says it isn’t aware of any malicious use.
What Cisco says to do
- Look up each Cisco product you run in the advisory. Cisco says anything not listed is not affected.
- Many cloud services (Duo Cloud, Secure Access, Webex and others) are remediated or in progress, with no customer action needed.
- For on-prem products, apply the fixed release or the product-specific guidance it lists. Duo Access Gateway 3.2.0 is out now, and ISE, IOS XR, Secure Firewall and others have their own guidance and dates. Some fixes don’t land until December or later.
- Some products are still under investigation, so bookmark the advisory and check back.
On the Apple side, I noted in my macOS 27.3 beta post that Apple is removing the eMudhra certs too.
My take
CA cleanups like this drag on for months, in appliances, Java keystores, containers and VPNs. Inventory where you trust these certs, and update as fixes land.
God Bless, and Use the Source!
References & Further Reading
- Cisco informational: emergency distrust of eMudhra root and intermediate CAs (Cisco)
- eMudhra’s CA Private Keys Were Compromised (EtherNinja)
- Update: macOS 27.3 beta brings an eMudhra fix (EtherNinja)
- As eMudhra exits cert business, users face new PKI trust decisions (Slashdot)
- eMudhra to exit global SSL/TLS business (The Hacker News)
