Unverified50% confidenceEventExact time
The private keys of eight intermediate CA certificates of the Indian certificate authority eMudhra were leaked.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/21/2026
First Seen
Valid until: 11/4/2026
Sources
Related Entities
Related Claims
UnverifiedAfter the intermediate CA private keys leak, attackers could theoretically forge valid TLS certificates for any domain.63% similarUnverifiedSSL Pinning机制在客户端代码中硬编码服务器证书的公钥指纹或证书哈希，拒绝接受非预期CA签发的证书，即便该CA已被系统信任库收录62% similarUnverifiedA rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.62% similarUnverifiedSeven records in the report used Amap API credentials, one pair of which was described as a Key and secret exposed in another company's source code, and this Key returned real location data.62% similarUnverifiedCertificate Transparency (CT) logs require CAs to publish every certificate they issue, so if attackers issue certificates, in theory a public record will be left behind.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1078535API
curl https://kongchang.com/api/v1/knowledge/claims/1078535MCP
get_claim(id=1078535)