MediumII Cyber Warfare & Critical Infrastructure20 October 2026, Tuesday
Browsers pull trust from compromised Indian certificate authority eMudhra
Mozilla and Google confirmed on 20 October that the private keys of 8 intermediate certificates belonging to eMudhra had been compromised. Chrome, Firefox, Apple, Microsoft and Go blocked the certificates between 17 and 20 October.
According to The Hacker News on 20 October, a researcher known as Wayne proved on the evening of 17 October that he held the private keys of 8 intermediate certificates by signing a message with each one. An intermediate certificate is the layer that signs the certificates websites present; whoever holds these 8 keys can issue fake HTTPS certificates that browsers will accept. Six of the 8 certificates were for websites (TLS) and 2 for code signing.
Chrome deployed its block at 19:45 UTC on 17 October and Mozilla at 22:59 UTC the same day; Apple followed on 19 October and Microsoft on 20 October. Go issued emergency patches in versions 1.27.3 and 1.26.10 on 20 October and is not fixing 1.25 or earlier. Mozilla and Chrome also decided to remove trust in the emSign ECC Root CA - G3 root certificate. Before the block, Chrome found no site certificates chained to the 6 intermediates in Certificate Transparency logs.
Mozilla bug 2083449 shows eMudhra revoked the 8 intermediates on 18 October. The company said about 30,000 certificates must be migrated, 97% of them issued through the automated ACME protocol. Two explanations of the root cause conflict. eMudhra says a second, weak key pair with similar labels was used by mistake during the key generation ceremony. An analysis by Mozilla engineer Dennis Jackson, however, shows the P-384 private keys were integers smaller than 256.
Talay assessment
Bottom line
Browsers had blocks in place within 5 hours and Certificate Transparency logs show no trace of misuse, so direct damage looks contained. The real cost is the root being pulled from trust: about 30,000 certificates must move to a new chain, and systems that are not updated will throw connection errors. The 2 conflicting accounts of the root cause make it likely that eMudhra's other roots come under review too.
Likely effects
- India's digital trust infrastructureNegative1–6 months
eMudhra's emSign brand issues both web and code-signing certificates; losing 8 keys weakens the standing of Indian certificate authorities in root programmes.
- Enterprise ITNegativeWeeks
There is no patch for Go 1.25 and earlier, so programs must be recompiled; the risk of an unblocked chain will persist for weeks in legacy software and embedded systems.
- Root programmesUncertain1–6 months
Chrome found no similar flaw at any other authority; the incident will speed up tighter rules on auditing key ceremonies.
Possibilities, ranked
- 1G3 root is removed and the case closes55%
No misuse is found, emSign ECC Root CA - G3 is dropped from browsers and customers move to the new chain.
Watch: Mozilla's root cause report and version 43 of the Chrome root store
- 2The review widens35%
Trust restrictions extend to eMudhra's other roots, including emSign Root CA - G1, which Chrome is examining.
Watch: A Chrome or Mozilla decision to restrict or remove emSign Root CA - G1
- 3Misuse comes to light10%
A fake certificate issued with the keys is detected in the wild, turning a certificate breach into an attack campaign.
Watch: Evidence of a fake emSign chain in Certificate Transparency logs or threat intelligence reports
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Intermediate certificates compromised▲ 8
- Certificates to be migrated▲ ~30,000