Eight intermediate certificates from eMudhra, an Indian certificate authority, had private keys a computer could guess in under a second. eMudhra first blamed an April 2025 key-generation ceremony, then acknowledged on October 26 that a script error produced the weak keys. Browsers and operating systems are now removing trust in the parent root, not just the eight certificates.
eMudhra revoked all eight on October 18 and exited the global TLS certificate business on October 22. Chrome began removing the parent root, emSign ECC Root CA – G3, on October 27. Microsoft removed seven associated certificates from Windows trust on October 26, and about 30,800 unexpired precertificates in public Certificate Transparency logs sat under the root as of October 21.
Why it matters
If attackers exploited these keys, they could impersonate any website and read encrypted traffic on networks they control.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
8
Compromised certificates
Intermediate certificates with trivially recoverable private keys.
3-8 bits
Private key entropy
Normal P-384 keys contain about 384 bits of entropy.
100 minutes
Chrome response time
Time from the 18:05 UTC report to the 19:45 UTC CRLSet block on October 17.
3 hours
Firefox response time
Time from report to OneCRL block on October 17.
18 months
Time undetected
How long the weak keys sat in browser trust lists, through two independent audits, by eMudhra's account.
30,800
Unexpired precertificates under the root
As of October 21, counted in public Certificate Transparency logs. 99.9% were issued through InCommon.
7
Windows certificates removed
Certificates tied to the affected hierarchies that Microsoft removed from the Windows trust list on October 26.
21 events
Latest: October 28th, 2026 · 2 weeks ago
Showing 8 of 21
JK to step
Tap a bar to jump to that date
October 2026
eMudhra reports progress on customer transition
LatestResponse
eMudhra's Update 6 reports progress moving customers off its TLS certificates. It says its digital signature, eSign, emSigner, CertiNext, emCA, PrivaTrust and SecurePass products are not affected.
Root removal scheduled
Mitigation
Google plans to remove emSign ECC Root CA - G3 from the Chrome Root Store.
Chrome begins removing emSign ECC Root CA – G3
Mitigation
Chrome begins removing the emSign ECC Root CA – G3 root from its trust store. Chrome will stop trusting certificates that chain to that root.
eMudhra acknowledges script error
Response
eMudhra acknowledges that a script error produced the weak keys. The company had earlier pointed to a key-generation ceremony.
Microsoft removes seven certificates from Windows trust
Mitigation
An out-of-band Windows update removes seven certificates tied to the affected hierarchies from the Windows trust list. Microsoft had blocked the certificates on October 20.
Apple prepares macOS fix
Mitigation
Apple is working on a macOS update with an additional fix. Its blocking of the eMudhra certificates in Safari and Mail, in place since October 19, needs no software update.
Oracle issues second emergency Java alert
Mitigation
Oracle's second emergency Java alert, for CVE-2026-114820 (CVSS 9.1), removes the affected roots.
Apple blocks emSign ECC Root CA – G3
Mitigation
Apple blocks the emSign ECC Root CA – G3 root. Some command-line tools on Mac may still accept the compromised certificates until a future update.
eMudhra board decides to exit global TLS business
Response
The board decided to withdraw from the global SSL/TLS certificate business, five days after the researcher's report. About 30,000 certificates need to move to other providers, most of them issued by automated renewal.
Second Android Firefox fix
Mitigation
Mozilla releases Firefox for Android 158.0.2 after some phones failed to apply the bundled OneCRL blocklist at startup.
Firefox releases emergency updates
Mitigation
Firefox 158.0.1 and ESR updates ship to cover users whose custom settings blocked OneCRL.
Microsoft blocks the certificates
Mitigation
Microsoft blocks the affected eMudhra certificates, three days after the first report.
Sectigo revokes certificates
Mitigation
Sectigo revokes certificates chaining to the compromised intermediates.
Apple blocks the certificates
Mitigation
Apple adds protections against the affected eMudhra certificates for its users.
eMudhra revokes certificates
Mitigation
eMudhra revokes all eight compromised intermediate certificates on October 18, about a day after learning of the issue on October 17.
Compromise reported
Disclosure
Security researcher reports the weak keys to the Chrome Root Program, proving control by signing a message.
Chrome blocks certificates
Mitigation
Chrome lands a CRLSet update blocking the affected intermediate certificates by key hash.
Firefox blocks certificates
Mitigation
Mozilla completes OneCRL distribution blocking the affected certificates for all standard Firefox users.
India opens probe into the weak keys
Investigation
India's electronics and IT ministry sets up a panel to examine how the weak keys were generated. CERT-In issues an advisory describing the eight certificates as six TLS and two code-signing certificates.
eMudhra commissions independent expert review
Investigation
eMudhra said it will publish a full root-cause analysis through the CCADB, and that an independent expert will review the incident and its controls.
April 2025
Weak keys generated
Incident
At a key-generation ceremony, a wrap/unwrap step produces a second, weak set of keys alongside the intended ones, and the weak set is what gets published.
Scenarios
1
No fraudulent certificates found in the wild
Likely
Resolves by Jan 31, 2027
Discussed by: Chrome Root Program, Mozilla
Certificate transparency logs show no fraudulent certificates issued from the compromised intermediates before they were blocked. If this holds, the incident becomes a near-miss: the weak keys were discovered before they were exploited. The cleanup continues for months as Linux distributions and IoT devices update their trust stores.
2
Fraudulent certificates discovered
Unlikely
Resolves by Jan 31, 2027
Discussed by: Security researchers
An attacker used one of the weak keys to issue a certificate for a high-value domain. The certificate could have been used in a man-in-the-middle attack against VPN users or other targets. Discovery would come from CT log monitoring or a security researcher's investigation.
3
Root removal breaks legitimate websites
Possible
Resolves by Nov 30, 2026
Discussed by: Google, eMudhra
Google removes emSign ECC Root CA - G3 from the Chrome Root Store on October 27. Websites with certificates chaining to this root stop working in Chrome. eMudhra has committed to helping customers migrate, but some may not complete the transition in time.
4
Another hierarchy turns out to be built on weak keys
Unlikely
Resolves by Apr 30, 2027
Discussed by: eMudhra, security researchers
eMudhra says that, to the best of its knowledge, no other roots or intermediates came out of the flawed April 2025 process. If a second hierarchy generated the same way surfaces in browser trust stores, the cleanup widens well beyond eight certificates.
5
Chrome drops the rest of eMudhra's roots
Uncertain
Resolves by End of 2026
Discussed by: Google Chrome Root Program
Chrome is still deciding whether to keep eMudhra's remaining CA certificates, including the G1 RSA roots. eMudhra says G1 will keep serving customers until the migration is finished.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
1 of 3
July-September 2011
DigiNotar breach (2011)
In July 2011, attackers breached Dutch certificate authority DigiNotar and issued fraudulent certificates for Google, Yahoo, Mozilla, and Tor. The breach went undetected for over a month.
Then
Browser makers revoked trust in DigiNotar within days. The company filed for bankruptcy in September 2011.
Now
The incident led to stricter CA oversight and helped drive the development of certificate transparency.
Why this matters now
Shows the consequences of a compromised CA: browsers revoke trust, and the CA often collapses.
2 of 3
April 2014
Heartbleed bug (2014)
In April 2014, researchers disclosed Heartbleed, a bug in OpenSSL that let attackers read memory from servers. The bug affected an estimated 17% of secure web servers.
Then
Organizations worldwide rushed to patch and rotate keys. The bug was patched within days, but cleanup took months.
Now
Led to the creation of the Core Infrastructure Initiative and increased funding for OpenSSL.
Why this matters now
Filippo Valsorda compared the eMudhra cleanup to Heartbleed, noting the long tail of affected devices.
3 of 3
May 2012
Flame malware (2012)
In May 2012, researchers discovered the Flame malware, which used a forged Microsoft certificate to spread. The certificate was signed using a weak MD5 hash collision.
Then
Microsoft issued an emergency update to block the certificate.
Now
Demonstrated that even major software vendors can have weak cryptographic implementations.
Why this matters now
Shows how weak cryptographic material can be exploited to forge trusted credentials.
