eMudhra certificate keys compromised: browsers block eight, Chrome to drop a root
Representative image: Engin_Akyurt / Pixabay
Private keys of eight eMudhra intermediate certificates were found to be trivially weak on October 17, 2026; Chrome, Firefox, Apple and Microsoft have blocked them.
What Happened
Private keys behind eight intermediate certificates issued by eMudhra, the Indian company that runs a certificate authority, were found to be so weak that anyone could work them out, after a researcher reported the problem on October 17, 2026. Google Chrome, Mozilla Firefox, Apple and Microsoft blocked the certificates between October 17 and 20, and Cloudflare has published guidance warning that software outside the browsers also needs updates. eMudhra has blamed an error in a script it used to generate the keys in April 2025.
Key Facts
- A researcher reported the problem on October 17, 2026; Cloudflare says it became aware on October 19 at about 17:00 UTC.
- All eight keys used the P-384 standard and were created in April 2025; Mozilla's investigation found each used a number smaller than 256, and one was simply "4".
- Chrome and Firefox blocked the certificates on October 17, Apple on October 19 and Microsoft on October 20, according to reports of the browser makers' statements.
- Chrome says it will remove the eMudhra root certificate that signed these intermediates in version 43 of its root store; Mozilla is removing it from its trusted list.
- eMudhra says one affected intermediate was in production use but none had issued certificates to websites or users.
- Cloudflare says it found no active exploitation on its services and released updated apps, including its 1.1.1.1 app.
Why It Matters
Every time a browser shows a padlock, it is trusting a chain of digital certificates. A certificate authority (CA) is a company trusted to vouch that a website really belongs to whoever claims it. CAs sign "intermediate" certificates, which in turn sign the certificates of individual websites. The private key of an intermediate is its signature stamp: whoever has it can create certificates that computers will accept.
That is why this incident is serious even though no attack has been reported. With keys this weak, an attacker could in principle have created a fake certificate for any website, such as a bank, and a computer that still trusted the eMudhra intermediates would have accepted it. That kind of forgery is what lets an attacker quietly read or alter traffic that appears secure.
Browsers were protected quickly for two reasons: their makers pushed block lists within days, and modern browsers insist that certificates appear in Certificate Transparency logs, public records of every certificate issued. Cloudflare says these intermediates have no entries in those logs, so they could not have been used against such browsers. The bigger worry is everything else. Cloudflare points out that many programs outside browsers, from command-line tools to apps, servers, containers and connected devices, keep their own lists of trusted certificates and do not check the transparency logs. Those systems stay exposed until they are updated.
For India, the incident is a test for a home-grown trust provider. It puts an Indian certificate authority under the close scrutiny of the global browser makers, who alone decide which CAs their users trust, and it shows how a single error in a key-generation script can ripple through software worldwide.
| eMudhra incident timeline | Date |
|---|---|
| Weak keys created | April 2025 |
| Problem reported to browsers | October 17, 2026 |
| Chrome and Firefox block | October 17, 2026 |
| Apple blocks | October 19, 2026 |
| Microsoft blocks | October 20, 2026 |
Impact
Short-term: Ordinary users of up-to-date Chrome, Firefox, Safari and Edge are already protected. Companies and developers need to update operating systems, programming-language libraries and apps that carry their own trust lists; Go, for example, released versions 1.27.3 and 1.26.10 that reject the eight keys. Cloudflare warns against "fixing" certificate errors by switching off verification.
Long-term: Chrome's plan to remove the signing root, and its review of eMudhra's other roots, could limit where eMudhra's web certificates are trusted. Websites using certificates from the affected chain may need to move to other providers.
Who is affected: eMudhra and its customers, IT and security teams at Indian and global companies, software developers, makers of connected devices, and anyone using older software that has not received the updates.
Key Takeaway
Eight eMudhra certificate keys were trivially weak; browsers are protected, but other software must be updated to stop trusting them.
Questions and Answers
What happened with eMudhra certificates in October 2026?
On October 17, 2026, a researcher reported that the private keys of eight eMudhra intermediate certificates, created in April 2025, used tiny numbers and could be recovered almost instantly. Major browsers blocked the certificates between October 17 and 20, and eMudhra said a key-generation script error caused it.
Am I at risk if I use Chrome or Firefox?
According to Cloudflare and the browser makers, users of updated Chrome, Firefox, Safari and Edge are protected, because the certificates have been blocked and do not appear in public Certificate Transparency logs.
Who still needs to act?
Organisations and developers running software that keeps its own trusted-certificate list, such as servers, containers, apps and connected devices, should install vendor updates. Cloudflare advises testing the actual verification path and never disabling certificate checks to clear errors.
Was any website attacked using these certificates?
eMudhra says none of the affected intermediates issued certificates to websites or users, and Cloudflare says its review found no active exploitation on its services.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
ISACA survey: 47% of women in tech report gender discrimination at work
DeepSeek ban: US orders agencies to remove Chinese AI; Beijing objects
Reported, fact-checked and published by the Peepals Global Editorial Team.
