The padlock in your browser only works if the companies behind it keep their keys secret. In October 2026, that promise broke for eMudhra, an Indian certificate authority. Researchers found that eight of its intermediate certificates used private keys so weak that anyone could work them out.
Browser makers moved within hours, so most people were protected. Still, the eMudhra certificate compromise affects some websites and apps. In this guide, you will learn what happened, who is affected and what to do.
Quick answer: Eight eMudhra intermediate certificates (six for websites, two for code signing) had weak private keys. Chrome, Firefox, Apple and Microsoft blocked them between 17 and 20 October 2026. Regular users should update their browser and devices. Website owners with a certificate that chains to “emSign ECC Root CA G3” should replace it with one from another provider.
What is eMudhra?
eMudhra is a certificate authority based in India. It sells website security certificates under the emSign brand through companies in India, the United States and the Netherlands. A certificate authority vouches that a website is really who it claims to be. That check is what lets your browser show a secure connection.
Each eMudhra certificate sits in a chain of trust. A root certificate sits at the top, and intermediate certificates sign the certificates that websites use. If an intermediate key leaks, an attacker could create fake certificates for any website.
What happened in the eMudhra certificate compromise?
The problem started long before anyone noticed it. On 30 April 2025, eMudhra held a key ceremony to create new intermediate certificates. According to eMudhra’s early findings, a flaw in a key wrapping step created a second, weak set of keys. eMudhra then used those weak keys for eight intermediate certificates.
How weak were they? Reports on Mozilla’s bug tracker show the private keys were tiny numbers. In practice, anyone could recover them almost instantly.
The eight affected certificates were:
- Six for websites (TLS): domain validated, organization validated and extended validation certificates in the G3B and G3C series
- Two for code signing, used to sign software
eMudhra certificate timeline
| Date | What happened |
|---|---|
| 30 Apr 2025 | Weak keys created during a key ceremony |
| 17 Oct 2026 | Researcher reports the issue; Chrome and Mozilla block the certificates |
| 19 Oct 2026 | Apple adds protection; Android protected through Google Play services |
| 20 Oct 2026 | Microsoft blocks them; Firefox 158.0.1 released |
| 21 Oct 2026 | CERT In issues an advisory for Indian users and organizations |
| By 27 Oct 2026 | Chrome removes the emSign ECC Root CA G3 root on all devices |
Was any fake eMudhra certificate used?
Fortunately, there is no sign of that. Google says no website certificates from the six affected intermediates appeared in Certificate Transparency logs before it blocked them. Since Chrome requires every public certificate to appear there, Google says attackers could not have used fake certificates from these intermediates against Chrome users.
eMudhra also says it issued no certificates from these intermediates, nobody breached its systems, and the incident does not affect its digital signature (DSC) and eSign services.
Which sites does the eMudhra certificate issue affect?
Google did more than block the eight certificates. It is also removing the root that signed them, called “emSign ECC Root CA G3”, from the Chrome Root Store. According to Google’s security post, that update should reach all devices by 27 October.
As a result, some legitimate website certificates that chain to this root will stop working in Chrome. Visitors would see a security warning instead of your site. eMudhra estimated on Mozilla’s tracker that about 30,000 certificates need to move to a new provider.
What should website owners do?
Follow these steps to check your site:
- Check who issued your certificate. Click the padlock in your browser address bar, open the certificate details and look at the issuer and the top of the chain.
- Look for an eMudhra certificate chain. If the chain ends at “emSign ECC Root CA G3”, you need to act.
- Get a new certificate now. Buy or request a certificate from a different trusted provider and install it. Many hosts offer free certificates through Let’s Encrypt.
- Test your site. Open it in Chrome, Firefox and Safari after the change, on both desktop and phone.
- Check your apps and APIs. If your servers call other services, make sure those calls still work after the trust store updates.
India’s cyber security agency, CERT In, gives similar advice in its advisory CIAD 2026 0050: update browsers and trust stores, and replace certificates that chain to the affected root where required.
If your certificate comes from another provider, such as Let’s Encrypt, DigiCert or Sectigo, this incident does not require action from you.
What should regular users do?
For most people, the fix is simple. Keep your software updated.
- Update your browser. Chrome and Firefox blocked the certificates through quick security lists that work without a full update. Even so, installing the latest version is the safest choice.
- Update your phone and computer. Apple and Microsoft added protections on 19 and 20 October.
- Never ignore certificate warnings. If a site shows a security warning, do not click past it, especially on banking or shopping pages.
Cloudflare also gave a clear warning: do not fix certificate errors by turning off certificate checks.
What about other software?
Browsers were the easy part. Other apps that keep their own list of trusted certificates may still trust the bad intermediates until they update. For example, the Go programming language added blocks in versions 1.27.3 and 1.26.10, but developers must rebuild their programs to get them. Some Linux certificate packages and command line tools may also lag behind.
So, if you run servers or build software, update your system certificate packages and rebuild apps that bundle their own certificate list. This is also a good time to review server security in general. For instance, our guide to PHP2Shell covers a critical PHP flaw patched the same week.
Why the eMudhra incident matters
This was not a hack in the usual sense. Instead, a flawed process quietly created weak keys and nobody caught it for 18 months. That is a lesson for every organization that handles security keys: test your processes, not just your systems.
On the bright side, Chrome blocked the six affected eMudhra certificate authorities for websites less than two hours after the report. For more online safety tips, read our guide on how to tell if a photo is AI generated.
FAQ about the eMudhra certificate issue
Is my emSign SSL certificate still valid?
If it chains to emSign ECC Root CA G3, it will stop working in Chrome once the root is removed. Replace it with a certificate from another provider.
Are eMudhra DSC and eSign affected?
eMudhra says this incident does not affect its digital signature certificates (DSC) or eSign services.
Do I need to update Chrome or Firefox?
Both browsers already blocked the bad certificates through background security lists. Still, updating to the latest version is the safest choice.
Were any fake certificates issued?
Google says none of the affected website certificates appeared in Certificate Transparency logs before the block, and eMudhra says it issued none.