eMudhra CA Key Compromise: What Indian IT Teams Must Do

In short: On 17 October 2026, a researcher showed that the private keys of eight eMudhra intermediate certificates, six for website TLS and two for code signing, could be recovered. Browsers and Microsoft have blocked them and eMudhra has revoked them. Indian IT teams should update software, check for emSign G3 certificates and replace any affected ones.

What Happened

eMudhra is an Indian certification authority (CA) that issues digital certificates, including website certificates sold under the emSign brand. According to Mozilla's public incident record, Bugzilla bug 2083449, an external researcher emailed Mozilla, Apple, Chrome, Microsoft and eMudhra on 17 October 2026 with proof that the private keys of eight eMudhra intermediate certificates were compromised.

Mozilla's preliminary finding is that these keys were extremely small numbers instead of random values, so they could be recovered easily. Mozilla describes this as a key generation flaw. In its statement on the same record, eMudhra blamed human error and a flaw in a key generation script used during an April 2025 key ceremony, and said the cause is still under investigation.

The record shows eMudhra revoked the eight certificates on 18 October. BleepingComputer, reporting on 20 October, said Mozilla, Google and Apple have blocked them, and The Hacker News reported that Microsoft also blocked them on 20 October.

Which Certificates Are Affected

Per Mozilla's record and The Hacker News report:

• Six TLS intermediates: EM DV, OV and EV TLS CA, each in G3B and G3C versions, used to issue website (HTTPS) certificates.
• Two code signing intermediates: EM OV CS CA G3B and G3C.
• Sectigo cross-signs: Sectigo had cross-signed matching intermediates and says it has revoked them.

Mozilla has also removed trust in the emSign ECC Root CA G3, and eMudhra has confirmed it stopped issuing from that root. According to the Mozilla record, eMudhra said about 30,000 certificates need to move to chains under its G1 root, most of them issued through automated (ACME) tools.

There are open questions. eMudhra says no end-user certificates were issued from the compromised intermediates, and Chrome found none logged in Certificate Transparency before its block. However, it is not known how many parties hold the keys or whether they were misused. None of the sources we checked say that eMudhra's Indian Digital Signature Certificates (DSC) or eSign services are affected, but they also do not rule it out, so ask your provider directly.

Why It Matters for Indian Businesses

A CA's intermediate key is what makes a website certificate trusted. With these keys, an attacker could create a fake certificate for a website they do not control and impersonate it, as Mozilla noted. Browsers now reject them, but many other programs do not check revocation lists. Servers, scripts, payment and API integrations, older Android apps and embedded devices often carry their own list of trusted certificates and may keep trusting the bad chains until updated.

There is also a reverse risk. Because a root has been removed, some legitimate websites and APIs using emSign G3 chains may stop working for certain users and systems until they move to new certificates.

What to Do Now

1. Update browsers and operating systems: Make sure Chrome, Edge, Firefox (158.0.1 or later where Remote Settings is blocked) and macOS, iOS and Windows devices have their latest updates.
2. Find emSign certificates you use: Check your websites, load balancers, mail servers, VPNs and code signing tools for certificates issued under emSign G3 chains, and list them.
3. Replace affected certificates: If any of your certificates chain to the affected G3 intermediates or root, ask eMudhra or another CA for a replacement and install the new chain.
4. Update non-browser software: Apply updates to Go (1.27.3 or 1.26.10, then rebuild), Python certifi, Rust webpki-roots and Linux ca-certificates packages, and watch for fixes from Node.js and other runtimes.
5. Test your integrations: Check that payment gateways, government portals, partner APIs and internal apps still connect after updates, since some legitimate chains may now fail.
6. Ask about DSC and eSign: If you use eMudhra for digital signatures or eSign, ask your provider in writing whether any part of your service is affected and keep the reply on file.

Mozilla engineer Dennis Jackson's tracking page, linked from BleepingComputer's report, lists patch status by software package and offers test endpoints to check whether a system still trusts the bad chains.

Frequently Asked Questions

Is my website unsafe if it uses an eMudhra certificate?

Not necessarily. Only certificates from the affected G3 chains need action. Check your certificate's issuer and chain, and replace it if it falls under the affected intermediates or the removed G3 ECC root.

Are Indian DSC or eSign services affected?

The sources we checked, including Mozilla's incident record, do not say so and do not list any document signing intermediates. Confirm with your provider before drawing a conclusion either way.

Do normal staff need to do anything?

Mostly they need to install browser and system updates. The main work falls on IT teams who manage servers, certificates and software that uses its own trust list.

How Affix Center Can Help

Incidents like this show why certificate tracking matters. Our earlier guide on SSL certificate validity and renewal explains how to keep an inventory, and our patch management process guide covers keeping trust stores current.

Affix Center's cybersecurity and IT operations teams can scan your websites and servers for affected certificates, plan replacements and test your integrations. Contact our team for a quick certificate check.