AWS Removes eMudhra CA Roots Over Key Recovery Flaw

AWS is pulling three eMudhra intermediate CA roots from its trust bundles due to CVE-2026-111943—a key-generation vulnerability that exposed private keys to recovery attacks. If you're running CloudFront custom origins or ALB with OIDC/JWT auth, check whether your certs chain to AAA Certificate Services, emSign Root TLS CA - G3, or emSign ECC Root CA - G3. Action required: reissue certificates from a different CA before AWS enforces the removal to avoid man-in-the-middle risks on soft-fail TLS clients.