Full Breakdown
eMudhra’s Weak-Key Certificate Flaw Triggers Global Browser Blocks
By Drooid · · How we work
Core Event
In early October 2026, researcher “Wayne” disclosed that eight intermediate CA certificates from Bengaluru-based eMudhra contained private keys that were cryptographically weak. The keys—numeric values 4, 56, 66, 115, 155, 156, 230 and 237—could be recovered in less than a second. Six certificates were used for TLS web authentication; two were for code-signing. After the report on October 17, 2026, browsers blocked the certificates: Chrome within 1 hour 40 minutes, Firefox the same night, Apple on October 19, 2026, and Microsoft on October 20, 2026. Google announced removal of eMudhra’s root *emSign ECC Root CA-G3* from the Chrome Root Store on October 27, 2026.
Background & Context
eMudhra, a major Indian certifying authority, issues digital signature certificates for government services and a global PKI trusted by browsers. The compromised certificates originated from a key-generation ceremony on April 30, 2025. A software flaw during the “wrap/unwrap” step produced a second set of weak keys that were mistakenly published to trust stores.
Data & Statistics
- Eight intermediate certificates affected (six TLS, two code-signing).
- Private-key values: 4, 56, 66, 115, 155, 156, 230, 237.
- The vulnerable intermediates accounted for roughly 1 % of eMudhra’s global TLS revenue.
- eMudhra holds about 38 % of the Indian digital-signature market (2024 Frost & Sullivan).
- Approximately 30,000 customer certificates under the removed root must be re-issued.
- eMudhra’s shares fell ?20 % on October 21, 2026.
Official Statements & Responses
- eMudhra said the flaw was limited to the eight intermediates, that none issued end-entity certificates, and that its root keys and other intermediates remain secure.
- CERT-In advisory on October 21, 2026 warned that weak keys could enable fraudulent TLS or code-signing certificates and urged updates to browsers and trust stores.
- MeitY formed a special investigative team, noted the incident pertained only to eMudhra’s international PKI, and cautioned against “fear-mongering.”
- Browser vendors deployed emergency revocation updates that automatically blocked the compromised certificates.
Criticism & Opposition
- Capital-market commentator Rajeev Mantri called the breach a “26/11 equivalent digital disaster” and urged that those linked to the fiasco be barred from cybersecurity responsibilities.
Conflicting Reports & Gaps
- eMudhra asserts only one of the eight intermediates was ever deployed and no end-entity certificates were issued.
- Chrome and Mozilla logs show no TLS certificates chaining to the affected intermediates before the block.
- No public evidence has confirmed exploitation of the weak keys, leaving the actual risk level unverified.
Verbatim Quotes
- “It is beyond comprehension how a company primarily selling solutions around cryptography had no systems in place to alert them of cryptographic insecurity for intermediate keys generated by them for over a year and a half,” — Karan Saini, cybersecurity researcher
- “Removal of emSign ECC Root CA – G3 from browser and application trust stores may cause legitimate certificates chaining to that root to become untrusted, potentially disrupting affected websites and services,” — CERT-In
- “This entity should be finished off. Anybody who was linked to this fiasco should never get into a position of responsibility in cybersecurity.” — Rajeev Mantri, capital managing director
What’s Next
- Google will remove the *emSign ECC Root CA-G3* from the Chrome Root Store on October 27, 2026, potentially causing legitimate certificates that chain to this root to become untrusted.
- eMudhra is working with affected customers to re-issue certificates and with browser root-program operators to complete remediation.