> Source: [sk1000330](https://support.checkpoint.com/results/sk/sk1000330)

# sk1000330 - Check Point response to eMudhra compromised Intermediate CA's

| Property | Value |
|----------|-------|
| Solution ID | sk1000330 |
| Date Created | 2026-10-28 |
| Last Modified | 2026-11-02 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Check Point Firewall |
| Versions | R82.10, R82, R81.20, R82.20 |

## Symptoms

- PKI Vendor eMudhra published that the private keys of eight eMudhra intermediate CA certificates have been compromised.

The event was published on the 20th of October 2026, more info can be found here: [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/)

## Cause

According to the incident information, the underlying problem was **incorrect private-key generation by the CA** . The flaw allows the private keys to be recovered from information contained in the certificates themselves. The affected intermediate certificates were created in **April 2025**.

Possession of one of these intermediate CA private keys could allow an attacker to issue certificates and **impersonate websites or services** for clients that still trust the affected certificate chain.

The incident was demonstrated by signing a known message with each affected intermediate CA private key and verifying those signatures against the corresponding certificate public keys.

## Solution

Checkpoint is issuing updates to Trusted CA bundles under its control. An update was already published for the HTTPS inspection bundle included in package 4.2 which removes the issuing Root CA's in question.

We recommend:

* Update your HTTPS inspection trusted certificate bundle to the latest package (4.2 at the time of writing) and manually check that these two Root CA's no longer show up in the Trusted certificate bundle.
  1. emSign Root TLS CA - G3 (By eMudhra)
  2. AAA Certificate Services (By Comodo)

Steps:

1 Open SmartConsole.

2 Open HTTPS Inspection Policy.

3 Click the Trusted Certificates window under HTTPS Inspection Tools section:

![](https://static.checkpoint.com/apps/sk/1000330/c9553a65-0d91-4cf3-8558-390bbcbff665.png)

4: Make sure package is updated and the version is \>= 4.2

5: Make sure the Root CA's no longer show up in the Certificates list:

![](https://static.checkpoint.com/apps/sk/1000330/a528b094-9940-4e30-88ed-335b13304987.png)

\*The CA's can be manually disabled or imported back if trusting them is crucial.

Manual solution without package update:

Admins can manually disable and remove the trust of the bad certificates,

Steps:  
? Click to Show / Hide  
1. Open SmartConsole.
2. Open HTTPS Inspection Policy.

3. Click the Trusted Certificates window under HTTPS Inspection Tools section:  
   ![](https://static.checkpoint.com/apps/sk/1000330/c9553a65-0d91-4cf3-8558-390bbcbff665.png)

4. Check these Root Certificates:

   1. emSign Root TLS CA - G3 (By eMudhra)

   2. emSign ECC Root CA -- G3 (By eMudhra)

   3. AAA Certificate Services (By Comodo)

5. Click on Actions and select Disable.  
   ![](https://static.checkpoint.com/apps/sk/1000330/6d8c3016-5633-4fe2-b185-23cd955a19a1.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content