See below the new features common to all PKI Hub installations on Cryptographic Security Platform 1.5.1.

Compromised eMudhra intermediate CAs no longer trusted (ATEAM-19950)

In October 2026, it was disclosed that eMudhra, a public certificate authority (CA), had generated the private keys of eight intermediate CAs with insufficient randomness. The private keys can be recovered from the corresponding public certificates, allowing anyone with the recovered keys to issue certificates that could be accepted by clients that trust the affected certificate chains. Six of the affected intermediate CAs are used for TLS certificate issuance and two for code signing. Each intermediate CA also has a certificate cross-signed by AAA Certificate Services.

Cryptographic Security Platform - PKI Hub and its solutions validate certificates presented by external systems to which they connect, such as certificate authorities managed by CA Gateway, Microsoft Intune and Entra ID, CRL distribution points, SMTP servers, and SIEM systems such as Splunk and Syslog. Unless a trust store or CA certificate is explicitly configured for a connection, the solutions use trust stores embedded in the appliance operating system and container images.

In Cryptographic Security Platform 1.0.0 - PKI Hub 1.1.0 through Cryptographic Security Platform 1.5.0 - PKI Hub 1.6.0, these trust stores contain root certificates that can establish trust in the affected certificate chains.

An attacker who can intercept network traffic between the appliance and one of these external systems could potentially impersonate that system and read or modify the data exchanged over the connection, including credentials.

The following root certificates are no longer trusted:

As a result, Cryptographic Security Platform 1.5.1 no longer trusts the following compromised intermediate CA certificates. Each compromised key has two certificates: one issued by eMudhra and one cross-signed by AAA Certificate Services.