Eight eMudhra Certificate Keys Were Compromised
Eight intermediate certificate keys issued by eMudhra were found to be weak enough to recover from their public certificates. Anyone with those keys could potentially create fraudulent certificates to impersonate websites or services. Browser and platform vendors have moved to block the affected certificates, but some applications and systems may still rely on outdated trust stores. (Firefox)
What happened
A researcher reported the issue on October 17, 2026. The affected keys had been generated in April 2025. According to eMudhra’s explanation, a flaw in its key-generation process created a second, weak set of keys, and those were mistakenly selected for the certificates. The problem was not simply that an attacker stole securely generated keys: the weak keys could be recovered from certificates that were publicly available.
The certificates were intermediate CAs authorities that can issue certificates trusted through a higher-level root. Six were intended for TLS website certificates and two for code signing. eMudhra said none of the eight had been used to issue certificates to customers, and that its root keys and other businesses were not affected. Those are the company’s statements; whether anyone exploited the weakness before it was reported remains unknown. (The Hacker News)
What’s been done and what remains uncertain
Browser and platform vendors have blocked the affected certificates through revocation updates or software changes. Mozilla said most Firefox users received protection through its centralized blocklist without needing to restart or update the browser; it also released updates for users who might not receive that blocklist. The affected certificates have also been blocked in Chrome and on Microsoft and Apple platforms, though coverage depends on the software and its configuration.
That does not guarantee every program or device is protected. Some apps use their own certificate bundles, while servers, containers, development tools, and other software may not receive browser-style revocation updates. An up-to-date browser alone may not fix those separate trust stores. (Cloudflare)
What to do now
- Update browsers, operating systems, and apps. Install available security updates, including updates for apps that connect to the internet or validate certificates.
- If you manage systems, check every trust store in use. Review operating-system bundles, application-specific certificate stores, language runtimes, libraries, and custom or bundled trust configurations. Follow the current advisories for the exact products and versions you operate.
- Rebuild and redeploy affected images where needed. Updating a host may not update the certificate bundle inside a container or a separately packaged application. Check the image and its dependencies, then apply the appropriate vendor fix.
- Don’t disable certificate validation to work around errors. A certificate error after an update may be a sign that the protection is working. Investigate the cause and update the relevant trust store instead of turning verification off. (Cloudflare)
- If you rely on an eMudhra-issued TLS certificate, contact your certificate provider. Ask whether it is affected and whether replacement or reconfiguration is required. For organization-wide deployments, coordinate with your security or IT team.
How widespread is the risk?
The issue affects eight intermediate certificates, but that number does not tell us how many people or services were exposed. Browser vendors have blocked the certificates, and eMudhra says none issued customer certificates. However, systems that did not receive revocation information may have continued to trust them, and there is no public confirmation that the weakness was or was not exploited before discovery. (Mozilla)
For most people, the practical step is to keep software updated. Administrators should pay particular attention to non-browser software and custom trust stores. Further root-cause findings, vendor updates, or evidence of misuse could change the assessment.
