Blog

eMudhra: eight CA keys compromised, and what to check now

On 20 October 2026 Mozilla and Google's Chrome Root Program confirmed that the private keys of eight intermediate certificate authorities of the Indian CA eMudhra are compromised. Your browser is largely taken care of. Your servers, scripts and containers may not be.

What happened

A certificate authority vouches for who is behind a website, and software trusts it because its root certificate is on a built-in list. Whoever holds the key of a trusted CA can issue a valid-looking certificate for any domain.

That is the problem here. A researcher reported on 17 October that the keys of eight intermediates could be recovered. According to the Mozilla bug, a flawed script in eMudhra's key ceremony created a second, weak set of keys, and those were used by mistake. The private keys turned out to be tiny numbers. The ceremony dates from April 2025, so the weakness had existed for about 18 months.

Six of the eight are TLS CAs and two are code-signing CAs:

  • EM DV, OV and EV TLS CA, each as G3B and G3C
  • EM OV CS CA, as G3B and G3C

Who has already reacted

  • 17 October: Firefox and Chrome block the certificates.
  • 18 October: eMudhra revokes all eight.
  • 19 and 20 October: Apple and Microsoft block them too.
  • 20 October: Mozilla removes the root emSign ECC Root CA - G3. Chrome follows on 27 October.

Are you affected?

An attacker would have to be positioned to intercept your traffic, for example on a network they control, and then present a forged certificate. That is targeted rather than mass exploitation. But the keys are now public, so anyone in that position can use them.

Current browsers reject these chains. The risk sits with everything that brings its own list of root certificates and only learns about the change through an update:

  • Python with certifi, and Node.js with its built-in store
  • Java with its own cacerts
  • container images, which keep the state from the day they were built
  • a cacert.pem shipped inside an SDK or application
  • VPN gateways, proxies, firmware and other appliances

What to do now

  1. Update browsers and operating systems. That covers the ordinary workstation.
  2. Update your dependencies. In Python that means certifi 2026.10.19 or later, in every project and every virtual environment, not just the one you happen to be working on.
  3. Rebuild containers. Updating the host does not change an image that already exists.
  4. Look at your bundles. grep -c "emSign ECC Root CA - G3" <bundle> should return 0. In Python, python -c "import certifi; print(certifi.where())" shows which file is meant.
  5. Don't stop at that result. The intermediates were also cross-signed by Sectigo's old AAA Certificate Services root, so a bundle can trust them without listing any eMudhra root. Don't delete that root by hand, because that can break legitimate connections. Install a current bundle instead.
  6. Check your own certificates. If your site uses a certificate that chains up to emSign ECC Root CA - G3, you need a replacement from another CA before 27 October. Otherwise Chrome visitors will see an error.
  7. Review code signing. Anyone who checks signatures from eMudhra's code-signing chain should look at this separately, because it runs apart from the TLS trust stores.

Update, 1 November 2026: eMudhra has announced its exit from the global TLS certificate business and offers customers replacement certificates from Sectigo. Its other root, emSign Root CA - G1, remains trusted for now, and Google is still reviewing it. Further fixes are out, among them Node.js 22.23.4, 24.22.1 and 26.12.1, Go 1.27.3 and 1.26.10, and Red Hat is tracking the issue as critical. On 21 October Cisco Talos had seen no attacks in the wild. Google found no certificates under these intermediates in the public Certificate Transparency logs before the block. A comment in the Mozilla bug reports over 100,000 certificates logged afterwards, on 20 and 21 October, at least one of them for a researcher's domain. This has not been verified, and it conflicts with eMudhra's statement that it issued no certificates from these CAs itself.

Not sure which systems of yours still trust what? Pentesting and consulting →