● Covered by 11 sources · 15 reportsHigh impact10 negative5 neutral
Eight eMudhra Intermediate CA Keys Compromised, Triggering Widespread Blocks
Key points
- Eight eMudhra intermediate CA private keys were compromised.
- Compromise allows issuance of trusted certificates for any website.
- Mozilla, Chrome, Apple, and Microsoft blocked the certificates.
- Cloudflare deployed mitigations across its services.
- The issue was reported on October 17 and publicly disclosed on October 19, 2026.
- Wayne discovered the weakness on October 17.
- The eight certificates used P-384 private keys generated in April 2025.
- The private keys had values smaller than 256.
- Flüpke published one compromised private key on GitHub.
- The private key for eMudhra's "EM OV TLS CA - G3C" certificate had a value of 4.
- eMudhra blamed the issue on an error in a script.
- Mozilla shipped an NSS update removing the eMudhra root on October 20.
- Chrome Root Store v43 will remove the eMudhra root.
- The eight intermediates include six TLS issuing CAs and two code-signing CAs.
- All compromised certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025.
- Apple blocked certificates on October 19, and Microsoft on October 20.
- eMudhra revoked the compromised certificates.
- Mozilla cryptography engineer Dennis Jackson published a tool.
- macOS and its built-in curl utility may still trust revoked certificates.
- The two code-signing CAs were trusted by Microsoft.
- Many projects removed the emSign ECC Root CA - G3 from their roots of trust.
- eMudhra will exit its global SSL/TLS certificate business.
- eMudhra will replace affected customers' certificates with free ones from partners.
- Chrome's change to stop trusting the eMudhra root certificate is expected on October 27.
- Approximately 30,800 unexpired certificates were chained to the emSign ECC Root CA - G3 as of October 21.
- 99.9% of the unexpired certificates were issued through InCommon.
- InCommon moved its service onto eMudhra's CertiNext platform between April and July this year.
- V. Srinivasan, chairman of eMudhra Limited, cited increasing costs and complexities of compliance requirements for the exit.
- The SSL/TLS business generated only 1% of eMudhra's revenue.
- Go team released an urgent security patch.
- Go team shipped a targeted patch within 7.5 hours of notification.
- The compromised private keys had values of 4, 56, 66, 115, 155, 156, 230, and 237.
Intermediate CA Key Compromise
The private keys of eight intermediate Certificate Authority (CA) certificates issued by India-based eMudhra Limited have been compromised. These certificates chain to roots trusted by major root programs including Mozilla, Microsoft, Apple, and Chrome, as well as many downstream trust stores. The compromise means that anyone possessing these keys could issue a certificate for any website that a browser would accept, potentially enabling impersonation of websites and interception or modification of traffic.
Discovery and Disclosure
A researcher, identified as Wayne, reported the compromise to root program teams on October 17, 2026. To demonstrate the compromise, Wayne digitally signed a message, "We have a problem here - Wayne," using the private key of each of the eight intermediate CAs. The issue was responsibly disclosed to downstream trust stores on October 19, 2026, at approximately 17:00 UTC.
Industry Response
Following the report, major browser makers and root programs took immediate action. Chrome and Firefox blocked the eight certificates within hours of verification on October 17. Apple devices blocked them on October 19. Microsoft also confirmed the compromise. Cloudflare became aware of the issue on October 19, 2026, and prioritized patching critical services, deploying mitigations across its CDN, Developer, and Zero Trust products, and releasing updates for Cloudflare One Clients (WARP) and Cloudflare Tunnel (cloudflared).
The Go programming language also addressed the issue in its October 20 security releases, handling the fix on its URGENT track, which is reserved for threats to the ecosystem. No TLS certificates chaining to the six intermediates used for websites had been logged to Certificate Transparency before Chrome's block, meaning none could have been trusted by default in Chrome or other browsers requiring CT logging.
Ongoing Concerns
While browser makers and major applications have blocked the compromised certificates, the threat is not entirely resolved. Updating other components of the internet, such as Linux distributions and embedded and Internet of Things devices, will be a time-consuming process. The exact method by which the keys left eMudhra, when the compromise occurred, and whether anyone else holds them, remains unknown.
Updates
- The compromised private keys had values of 4, 56, 66, 115, 155, 156, 230, and 237.
- Go team released an urgent security patch.
- Go team shipped a targeted patch within 7.5 hours of notification.
- eMudhra will exit its global SSL/TLS certificate business.
- eMudhra will replace affected customers' certificates with free ones from partners.
- Chrome's change to stop trusting the eMudhra root certificate is expected on October 27.
- Approximately 30,800 unexpired certificates were chained to the emSign ECC Root CA - G3 as of October 21.
- 99.9% of the unexpired certificates were issued through InCommon.
- InCommon moved its service onto eMudhra's CertiNext platform between April and July this year.
- V. Srinivasan, chairman of eMudhra Limited, cited increasing costs and complexities of compliance requirements for the exit.
- The SSL/TLS business generated only 1% of eMudhra's revenue.
- Apple blocked certificates on October 19, and Microsoft on October 20.
- eMudhra revoked the compromised certificates.
- Mozilla cryptography engineer Dennis Jackson published a tool.
- macOS and its built-in curl utility may still trust revoked certificates.
- The two code-signing CAs were trusted by Microsoft.
- Many projects removed the emSign ECC Root CA - G3 from their roots of trust.
- Wayne discovered the weakness on October 17.
- The eight certificates used P-384 private keys generated in April 2025.
- The private keys had values smaller than 256.
- Flüpke published one compromised private key on GitHub.
- The private key for eMudhra's "EM OV TLS CA - G3C" certificate had a value of 4.
- eMudhra blamed the issue on an error in a script.
- Mozilla shipped an NSS update removing the eMudhra root on October 20.
- Chrome Root Store v43 will remove the eMudhra root.
- The eight intermediates include six TLS issuing CAs and two code-signing CAs.
- All compromised certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub Homebrew/homebrew-core GitHub nodejs/node GitHub certifi/python-certifi GitHub pypa/pip GitHub astral-sh/uv GitHub rustls/webpkiHow outlets covered it
eMudhra, a certificate authority, was found to have used extremely weak cryptographic keys, including the number 4, for its intermediate private keys. This vulnerability allowed anyone to instantly recover the signing keys from public certificates and create fraudulent certificates for any domain, posing a significant threat to internet security.
The Go team released an urgent security patch to address a critical public key infrastructure (PKI) compromise involving certificates issued by eMudhra. This compromise allowed for the trivial recovery of private keys, enabling attackers to sign arbitrary TLS certificates and perform man-in-the-middle attacks.
eMudhra, an India-based certificate authority, announced its withdrawal from the global SSL/TLS business. This decision follows revelations that it issued eight intermediate TLS certificates with private keys as small as 4 bits, making them easily crackable and posing a significant security risk.
Indian certificate authority eMudhra is withdrawing from the global SSL/TLS certificate business after eight of its intermediate certificates were found to have weak private keys. This issue allowed attackers to potentially issue fraudulent HTTPS certificates, leading major browsers to block eMudhra's certificates.
eMudhra, an Indian certificate authority, will exit its global SSL/TLS certificate business after a researcher recovered private keys for eight of its intermediate CA certificates. This decision follows Mozilla and Chrome's moves to distrust eMudhra's emSign ECC Root CA - G3, impacting approximately 30,800 unexpired certificates.
Eight insecure intermediate CA certificates from Indian firm eMudhra, including six TLS and two code-signing certificates, had easily guessable private keys, enabling attackers to impersonate any domain or sign malware as legitimate software. System administrators globally must update systems and software to revoke these certificates and prevent potential man-in-the-middle attacks or malware masquerading.
Private keys for eight eMudhra intermediate Certificate Authority (CA) certificates were compromised, allowing attackers to forge trusted certificates. The compromise stemmed from insecure key generation, where keys were not random, making them trivial to enumerate. This impacts systems relying on web Public Key Infrastructure (PKI) and has led to the removal of the emSign ECC Root CA - G3 from some roots of trust.
Apple blocked eight web security certificates that could allow scammers to impersonate legitimate websites. However, a cryptography engineer warns that macOS and its built-in curl utility may still trust these revoked certificates due to a lack of revocation checks, posing a potential risk for Mac users.
Major browsers including Chrome, Firefox, Safari, and Edge have blocked eight intermediate certificates from Indian CA eMudhra after their private keys were found to be compromised. The compromise stemmed from insufficient randomness during key generation, allowing attackers to potentially forge fraudulent certificates and impersonate websites.
A security researcher discovered that eight eMudhra intermediate certificate authority (CA) private keys were compromised because they were generated as single-byte numbers, making them trivial to crack. Major browsers like Chrome and Firefox have already blocked these certificates, and eMudhra's root certificate is being removed from root stores, impacting trust in certificates issued by eMudhra.
Certificate authority eMudhra revoked eight intermediate certificates after researchers discovered their private keys were weak and easily recoverable. Major browsers and operating systems, including Mozilla Firefox, Google Chrome, and Apple, implemented blocks to prevent the use of these compromised certificates, mitigating potential impersonation and interception risks.
Eight eMudhra intermediate certificate private keys were compromised, allowing attackers to forge certificates for any domain and intercept traffic. Cloudflare has deployed mitigations across its services and released updates for Cloudflare One Clients and Cloudflare Tunnel to protect its customers.
Eight TLS certificates issued by India-based eMudhra Limited were found to have weak private keys, allowing unauthorized creation of trusted browser and app credentials. Browser makers and major apps have blocked these certificates, but a widespread cleanup is required for other internet components like IoT devices and Linux distributions.
Eight intermediate certificate authority (CA) keys belonging to eMudhra were compromised, leading to emergency blocks by Mozilla and Google's Chrome Root Program. This compromise could allow unauthorized issuance of certificates for any website, potentially undermining trust in web security.
The private keys for eight eMudhra intermediate CA certificates have been compromised due to incorrect generation, allowing potential impersonation of websites and services. Mozilla, Microsoft, Apple, and Chrome root programs have taken action to block these certificates, and the CA has revoked them.