A major internet security incident has prompted emergency action from browser makers and software vendors after the private keys associated with eight certificate authority (CA) certificates operated by eMudhra were found to be compromised. The exposure could have allowed attackers to create fraudulent certificates that appeared trustworthy to browsers and applications.
What Happened?
The incident involves eight intermediate certificate authority certificates belonging to eMudhra, an India-based provider of digital identity and certificate services operating under the emSign brand. Security researchers reported on October 17, 2026, that the private keys for these certificates had been compromised.
Intermediate CA certificates occupy a critical position in the internet’s trust infrastructure. If an attacker obtains one of these signing keys, they can potentially create certificates for websites they do not control, causing browsers and software to mistakenly trust malicious sites.
Early reports highlighted an alarming discovery: some of the compromised private keys were extraordinarily weak. Security researchers found that one key effectively had a value of “4,” while others had similarly tiny values, making them trivially recoverable. Researchers were able to derive the keys almost instantly from public certificate data.
According to eMudhra, the issue stemmed from an error in a key-generation process conducted in April 2025. The company said a script generated a second set of weak keys that were mistakenly selected instead of properly generated cryptographic keys.
Could Attackers Have Forged Certificates?
Yes. Anyone possessing these private keys could have created certificates that appeared valid for virtually any website within the affected certificate chains. Such certificates could be used to impersonate websites or potentially intercept encrypted traffic under certain conditions.
However, major browser vendors reported that no evidence has been found so far showing the compromised keys were used to issue fraudulent TLS certificates that became trusted through Certificate Transparency logging systems.
The response from the technology industry was rapid.
- Mozilla blocked the affected certificates through Firefox’s OneCRL system within hours of receiving the report.
- Google’s Chrome Root Program verified the compromise and distributed protections through Chrome’s certificate-blocking mechanisms.
- Apple added protections on October 19, 2026.
- Microsoft also distributed protections through its trust infrastructure.
In addition, Firefox 158.0.1 and corresponding ESR updates were released to ensure protection for users who might not receive automated revocation updates.
eMudhra Revokes All Affected Certificates
eMudhra has revoked all eight compromised intermediate certificates and says it has found no evidence that the affected intermediates issued end-user certificates. The company stated that only one of the affected intermediates was ever deployed in production and that its root certificate infrastructure was not affected.
The company also said it is continuing its investigation and reviewing security controls and operational procedures.
Why the Incident Matters
Certificate authorities are a foundational part of internet security. Browsers trust them to verify the identities of websites, enabling HTTPS encryption. When an intermediate CA key is compromised, it undermines that trust chain and can potentially affect millions of users and services.
While major browsers and operating systems have already deployed protections, some applications, embedded devices, Linux distributions, and software projects may still require updates. Security experts warn that eliminating trust in the affected certificates across the broader internet ecosystem could take considerable time.
Latest Status
As of October 21, 2026:
- All eight compromised certificates have been revoked.
- Firefox, Chrome, Apple, and Microsoft have deployed protections.
- No confirmed malicious use of the compromised certificates has been publicly reported.
- The root cause investigation by eMudhra remains ongoing.
