eMudhra Intermediate CA Key Compromise — October 2026

Executive Summary

On October 17, 2026, a critical vulnerability in eMudhra's global TLS intermediate certificate authority (CA) was discovered, leading to the compromise of eight intermediate CAs that are trusted by major browser and operating system root programs. The private keys for these intermediates were generated with weak keys (a flaw in the key generation ceremony in April 2025), allowing anyone to recover them from the published certificates. The affected certificates were revoked on October 20, 2026, but many clients (especially non-browser applications and command-line tools) may still trust the compromised roots without Certificate Transparency enforcement. For ongoing coverage of certificate authority security, see our cybersecurity archives.

What Happened

An independent security researcher reported that the private keys of eight eMudhra intermediate CA certificates had been compromised. These certificates chain to the emSign ECC Root CA - G3 and are trusted by major browser root stores (Mozilla, Chrome, Apple). The flaw was a weakness in the key generation ceremony in April 2025 — a script error produced a second, weak set of keys alongside the intended strong keys. Because the weak keys were published to the browser root stores, anyone could recover them from the certificates.

A researcher demonstrated the key compromise by signing a message with each of the eight private keys and reporting it to the Root Program Teams on October 17. Mozilla and Chrome verified the findings and blocked the certificates within hours. The root programs used revocation mechanisms (OneCRL, CRLSet) to protect users.

Technical Deep Dive

Key Generation Ceremony Flaw

The vulnerability originated during a key generation ceremony in April 2025. During the key wrap/unwrap step, a script error produced a second, weak set of keys alongside the intended strong keys. The problem was a flaw in one step of the ceremony procedure, not the absence of HSMs (Hardware Security Modules). The HSMs were used correctly, but the key generation script had a bug that produced weak ephemeral keys.

Because the certificates were created with these weak keys, anyone can recover the private keys from the public certificates. This means the vulnerability existed from the moment the certificates were created in April 2025 and was only discovered in October 2026.

Certificates Compromised

Root Programs and Browser Blocking

• Mozilla: Received the report at 20:06 UTC on October 17 and finished pushing a OneCRL block to Firefox installations with standard settings at 22:59 UTC. Firefox blocks the compromised intermediates via OneCRL revocation data fetched automatically.
• Microsoft/Chrome: Received the report and had a CRLSet update blocking the six TLS intermediates in place by 19:45 UTC on October 17. Chrome's block matches the public key rather than the certificate, so it also catches the Sectigo cross-signed copies.
• Apple: Blocked the compromised intermediates on October 19, 2026, across macOS and iOS platforms.

Impact

Browser and OS Protection

• Firefox (Mozilla) blocked the compromised intermediates on October 19, 2026. Users are protected via OneCRL revocation data.
• Chrome/Edge (Microsoft) blocked them on October 20, 2026. Chrome's CRLSet mechanism revokes the certificates at the browser level.
• Apple (Safari, macOS) blocked them on October 22, 2026. Apple updated the system trust store to distrust the compromised intermediates.

Non-Browser Clients at Risk

Many applications and tools that do not enforce Certificate Transparency (CT) by default are still trusting the compromised roots:

• Electron apps (Slack, Discord, VS Code) — these apps rely on the system trust store but may not have received the new blocklist. Electron 44.9.1+, 43.8.1+, and 42.11.16+ include the fix, but many apps bundle older Electron versions.
• curl — the command-line tool uses its own CA bundle that may not have been updated.
• Python (via certifi bundle) — older versions of certifi may still trust the compromised roots until manually updated.
• Node.js (versions prior to 26.12.1) — may still trust the compromised roots.
• Java (OpenJDK) — may have its own CA bundle that hasn't been refreshed.
• Android devices that haven't received the Google Play services update blocking the affected certificates.

These clients can be attacked without any visible warning, because they do not check revocation information. An attacker with any of the compromised keys could impersonate any website or service that trusts them, and the connection would appear secure (green padlock) to users and applications that don't enforce Certificate Transparency.

About eMudhra

eMudhra is an Indian digital signature and e-signature provider that offers global TLS certificate issuance through its emSign brand. The compromise affects only eMudhra's global TLS intermediate CAs; the company's Indian digital signature certificate and eSign services are regulated by the Controller of Certifying Authorities and are unaffected.

eMudhra has issued a public apology and is conducting a thorough investigation into the incident. The affected intermediate CAs have been revoked, and eMudhra is offering customers certificates from alternate CAs (including Sectigo-issued certificates) at no cost. The company drew a line between its regulated Indian digital-signature business and its global TLS business, noting that the two run on separate infrastructure.

Mitigation Steps

For System Administrators

1. Remove the affected roots: On Debian/Ubuntu, run as root:

   sudo sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
     -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
     /etc/ca-certificates.conf && sudo update-ca-certificates

2. On macOS: Remove the affected roots manually:

   sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
     -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
     /etc/ssl/cert.pem && sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig

3. On Windows: Use the Windows certificate store to untrust the affected roots via PowerShell:

   Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\Spooler\Certificates" `
     -Name "emSign ECC Root CA - G3" -Value "0"
   Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\Spooler\Certificates" `
     -Name "AAA Certificate Services" -Value "0"

4. On Fedora/RHEL: Use the trust tool to blacklist the compromised roots:

   trust extract --format=pem-bundle \
     --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
     /etc/pki/nssdb/ && sudo systemctl restart nscd

For End Users

1. Update your browser to the latest version — all major browsers have already pushed the blocklist.
2. Update your operating system — OS updates include the new trust store with the compromised roots removed.
3. Update your tools — ensure certifi, Node.js, Python, and other tools are running the latest versions with updated CA bundles.

For Developers

1. Update CA bundles: Ensure all application dependencies include the latest CA certificate updates. This includes bundling updated root lists in mobile apps and desktop applications that ship with their own CA bundles.
2. Check Certificate Transparency: Enable CT logging verification in your TLS stack to detect any fraudulent certificates in the future. CT logs make it possible to detect certificates that were issued fraudulently, even if the issuing CA has been compromised.
3. Monitor for revocation: Ensure your TLS clients check OCSP (Online Certificate Status Protocol) or CRL (Certificate Revocation List) for certificate revocation status. Many clients skip this step for performance, which means they don't know when a certificate has been revoked.
4. Update Electron apps: Electron apps only pick up OS-level fixes once they are updated to a version built on a patched Electron release. If your desktop app uses Electron, update the bundled Electron version as soon as a patched version is available.

Long-Term Implications

This incident highlights several important lessons for the Web PKI ecosystem:

1. Key ceremony rigor: The key generation process must be auditable and resistant to script errors or procedural flaws. A single step error can compromise an entire hierarchy of certificates.
2. Revocation mechanisms: Many clients do not enforce Certificate Transparency or check revocation data, leaving them vulnerable even after certificates are revoked. The browser CRLSets and OneCRL mechanisms worked here, but many applications and embedded devices still don't check revocation status.
3. Root store maintenance: System trust stores must be kept up to date to protect users from compromised intermediates. Many servers, containers, and embedded devices run outdated CA bundles that still trust the compromised roots.
4. Cross-CA trust: The compromise of a single CA can have cascading effects across the entire ecosystem. The emSign ECC Root CA - G3 is shared across Chrome, Firefox, and Apple platforms, so the impact was global.
5. Independent audit importance: The flaw went undetected through two independent audit cycles, highlighting that audits alone are not sufficient to catch all security flaws. Post-incident analysis and external verification remain critical.

References

• eMudhra Incident Report (October 21, 2026) — https://emudhra.we-have-a-problem.com/
• eMudhra Official Statement — https://emudhra.com/en/post/certificate-security-incident
• Mozilla Security Blog — eMudhra intermediate CA compromise
• Chrome Security Blog — CRLSet update for compromised CA keys
• Apple Security Advisory — macOS trust store update for eMudhra incident
• Node.js Release Notes — v26.12.1 includes CA bundle updates
• Python certifi — latest version 3.15.1+ includes updated root lists
• Red Hat Security Advisory — RHSA-2026:5898-1 covers RHEL 6 through 10
• Debian Security Advisory — DSA-6572-1 removes emSign ECC Root CA - G3
• CERT-In Advisory — CIAD-2026-0050 warns of risks to non-Firefox users
• Go Security Release — CVE-2026-111943, Go 1.27.3 and 1.26.10 include the fix
• Ubuntu USN — USN-8944-1 for Ubuntu 22.04 through 26.10

Appendix: Mitigation Commands by Platform

Debian/Ubuntu

sudo sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
  -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
  /etc/ca-certificates.conf && sudo update-ca-certificates

Fedora

trust extract --format=pem-bundle \
  --filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
  /etc/pki/nssdb/ && sudo systemctl restart nscd

macOS

sed -i 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
  -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
  /etc/ssl/cert.pem && sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig

Windows (PowerShell)

Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\Spooler\Certificates" `
  -Name "emSign ECC Root CA - G3" -Value "0"
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\Spooler\Certificates" `
  -Name "AAA Certificate Services" -Value "0"

Node.js

Update to Node.js 26.12.1, 24.22.1, or 22.23.4 which includes the key blocklist and updated NSS root list.

Python

pip install --upgrade certifi

Java

Update to the latest OpenJDK that includes updated CA root lists, or manually update the cacerts keystore.

Docker

Rebuild container images based on RHEL or UBI images once the updated ca-certificates packages are released by Red Hat.

This article was published as part of the daily cybersecurity roundup for the Cybersecurity category (CATEGORY_ID: 7).

Images: