eMudhra CA Compromise: Eight Certificate Authority Keys Exposed by a Flawed Key Ceremony

Private keys for eight intermediate certificate authorities run by eMudhra, the Indian certificate authority that sells certificates under the emSign brand, have been exposed. Six of them could be used to issue HTTPS certificates that browsers would accept for any website. Mozilla and Google's Chrome Root Program confirmed the compromise on 20 October.

The keys were not stolen in a break-in. They were generated with far too little randomness, which means they can be calculated from the public certificates themselves.

How weak were the keys

eMudhra says the problem goes back to a key generation ceremony on 30 April 2025. A flaw in a key wrap and unwrap step produced a second, weak set of keys alongside the intended strong ones, and it was the weak set that ended up in the certificates published to browser root stores.

Security researcher Scott Helme said he recovered all eight private keys from the public certificates on a laptop in under a second. According to The Hacker News, one key was the number 4 and the rest were whole numbers below 256. The problem was reported to the root programs on 17 October by a researcher credited by Mozilla only as Wayne, who proved it by signing the message "We have a problem here" with each of the eight keys.

Browsers moved within hours

• Chrome: received the report at 18:05 UTC on 17 October and blocked the six TLS intermediates by 19:45 UTC the same evening, with no browser update or restart needed. Android devices received the block through Google Play Services on 19 October.
• Firefox: pushed a block to standard installations by 22:59 UTC on 17 October. Mozilla removed the emSign ECC Root CA - G3 from its NSS library on 20 October.
• Apple and Microsoft: blocked the certificates on 19 October and 20 October respectively, according to The Hacker News.

Chrome said no TLS certificate chaining to the six intermediates had been logged to Certificate Transparency before its block, so no forged certificate from them could have been trusted by browsers that require those logs. Whether anyone exploited the weakness before it was reported is not known.

Chrome will remove the emSign ECC Root CA - G3 from its root store, with the change expected to reach devices around 27 October. Legitimate certificates that chain to that root will stop working in Chrome after that.

The exposure is outside the browser

Browsers receive revocation updates automatically. A great deal of other software does not: programs written in Go, Node.js applications, Python tools using the certifi package, containers and many Linux systems rely on certificate stores bundled with the software or the operating system. Until those are updated, they may still trust certificates issued under the compromised keys.

Fixes released so far include:

• Go 1.27.3 and 1.26.10 (CVE-2026-111943), which reject chains containing any of the eight keys. Programs have to be rebuilt with the new version. Go 1.25 and older get no fix.
• Node.js 26.12.1, 24.22.1 and 22.23.4. Our report on the Node.js release.
• Python certifi 2026.10.19 and Rust webpki-roots 1.0.10, which drop the emSign ECC Root CA - G3.
• Ubuntu (USN-8944-1 and USN-8944-2) and Debian (DSA-6572-1) ca-certificates updates.
• Composer's ca-bundle 1.6.0 and 1.4.16, used by PHP applications.

Red Hat had not shipped package updates at the time of writing and recommends a workaround that blocks the affected roots in the system store. Several other distributions and tools were still pending.

What eMudhra says

eMudhra said its infrastructure was not compromised and no data was breached, that the incident does not affect its root CA private keys or its other intermediates, and that none of the eight intermediates issued any end-entity certificates. It said the problem is unrelated to its Indian digital signature certificate and eSign businesses, which run on separate infrastructure, and that its global TLS business accounts for around 1% of revenue. It has revoked the eight certificates and stopped issuing new certificates under its G3 root.

India's Ministry of Electronics and Information Technology (MeitY) has formed a team to investigate, and CERT-In has issued an advisory. eMudhra's shares fell 20% in Mumbai on 21 October, according to Business Standard.

What to do

1. Website operators: if your certificate chains to emSign ECC Root CA - G3, replace it with one from a different certificate authority before Chrome's root removal takes effect around 27 October.
2. Developers: rebuild Go programs with Go 1.27.3 or 1.26.10, update Node.js, and update certifi or webpki-roots in Python and Rust projects.
3. System administrators: apply your distribution's ca-certificates update, then rebuild container images so they pick it up.
4. Before removing a root: CERT-In advises checking whether any legitimate certificates your systems depend on chain to it, since removing the root breaks them too.