Back Darkreading

Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys

Darkreading •Jai Vijayan • October 20, 2026

Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.

Google, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers to impersonate any legitimate website or service.

The affected keys were associated with intermediate certificates issued by Indian CA eMudhra. Six were used to issue TLS certificates for websites while the other two were used for code signing.

Preventing Fraudulent Certificate Misuse

The blocks are designed to prevent browsers and applications from trusting fraudulent digital certificates that attackers might issue using the compromised keys, reducing the risk of website impersonation and the potential interception of encrypted communications.

However, the protections do not automatically extend to all users and applications. Mozilla, Google, and Apple have distributed blocks through their respective certificate-revocation mechanisms, while applications built with Go must be rebuilt using patched versions to receive the fix. Other software may also require updates, depending on how they manage certificate trust.

Related: Enterprise AI Enters Risk Management Phase as Security Concerns Rise

What remains unclear is whether attackers might have already used the compromised keys to issue fraudulent certificates . Google said its Certificate Transparency protections would have prevented affected TLS certificates from being trusted by default in Chrome before the blocks took effect.

Mozilla, meanwhile, said users with standard Firefox configurations received its block without needing to update or restart the browser. Go project maintainers said they "highly recommend" upgrading immediately to patched Go versions 1.27.3 and 1.26.10.

eMudhra is an India-based company that provides digital identity, electronic signature, and public key infrastructure (PKI) services. The company's services include issuing digital certificates to authenticate websites, electronic document signing, digital identity verification, and securing online transactions.

Dennis Jackson, a member of Mozilla's cryptography engineering team who is maintaining a timeline of the incident, described eMudhra as having revoked the compromised intermediate certificates. "This has already been remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such as OneCRL , CRLite and CRLSets ," he wrote. "However, many other clients do not consume revocation information and require software updates to ensure they no longer trust the compromised intermediates."

Related: When Your Ransomware Negotiator Works for the Other Side

Jackson recommended that users update their operating systems and browsers to the most recent versions as quickly as possible.

Details of Compromise Remain Unclear

For the moment, at least, no details are available on how the eMudhra compromise happened, or when. According to Jackson, Mozilla first learned of the compromise on Oct. 17 from a researcher who identified themselves only as Wayne. The researcher demonstrated that he had access to the private keys associated with all eight intermediate certificate authorities by using each key to create a digital signature on the same short message: "We have a problem here - Wayne.”

Mozilla completed the process of blocking the compromised certificates three hours later. "Mozilla's centralized list of revoked certificates which we introduced in 2015. OneCRL allows us to deliver this protection without requiring users to update or even restart Firefox," Jackson said.

Since then, Mozilla has been working with eMudhra "other root programs and downstream trust store operators to investigate the root cause, responsibly disclose the incident and help protect the wider ecosystem." Currently, Mozilla has no evidence that other CAs might have been similarly impacted he added.

Related: Passing the Baton: Dark Reading Names New Editor-in-Chief

Posting in the same group, a member of Google Chrome's Root Program Team described receiving news of the compromise around the same time that Mozilla did and addressing the issue in less than two hours.

"Following the initial block, we evaluated all other CA certificates in the Chrome Root Store trust boundary and found no other instances of this failure mode," the Chrome team member wrote, "We are also working with CT log software maintainers and log operators to reject certificates chaining to these compromised intermediate CAs going forward to prevent risk to the CT ecosystem."

Maintainers of the Go project, meanwhile, did not identify eMudhra by name. Instead, they merely noted their plans to block trust "in a small set of intermediate certificates" because of an unspecified operational security concern.

For organizations seeking to assess their exposure, the affected certificates include six TLS intermediates — EM DV TLS CA, EM OV TLS CA, and EM EV TLS CA, each with G3B and G3C variants — issued under emSign Root TLS CA - G3. The affected certificates also include two code-signing intermediates, EM OV CS CA - G3B and EM OV CS CA - G3C, issued under emSign Root CS CA - G3.

Compromises and errors involving certificate authorities have repeatedly forced browser makers to revoke trust in digital certificates over the years, In 2011, a breach at Dutch CA DigiNotar .

In 2017, Google, Mozilla, and other browser makers took issue with Symantec's chronic mis-issuance of certificates and moved to revoked in the CA; the dispute ended with Symantec eventually selling its CA business to DigiCert later that year. More recently, in 2025, Google announced it would no longer trust certificates from Chungwa and Netlock , over concerns the integrity of their operations.

Illinois-based Jai Vijayan is a veteran, award-winning technology journalist with more than 25 years of experience covering cybersecurity. His information security reporting has explored everything from ransomware, nation-state threats, and identity security to AI risk, critical infrastructure protection, software supply chain security, cloud security and emerging enterprise technologies.

Over the course of his career, Jai has written news stories, feature articles, survey reports, white papers, and e-books for enterprise and technology audiences. He has also moderated panel discussions and executive roundtables featuring CISOs, security researchers, and industry leaders.

Jai previously served as senior editor at Computerworld, where he covered information security and data-privacy issues. His work has also appeared in CSO Online, InformationWeek, The Christian Science Monitor Passcode, The Economic Times, and other publications.

His work has earned multiple industry honors, including a Joint ASBPE Excellence Award for Best Coverage of Government IT, and a Joint Jesse H. Neal Award for wireless LAN security coverage. Jai holds a Master’s degree in statistics from Bangalore University, and studied broadcasting and electronic communication at Marquette University in Milwaukee.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

How to Harness your Security Operations Data for Enterprise Defense

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

eMudhra CA Key Compromise: Weak Keys Lead to Browser Blocks The private keys of eight intermediate certificates issued by Indian CA eMudhra have been compromised due to weak key generation, allowing potential forgery of trusted HTTPS certificates. A researcher discovered the flaw on October 17, 2026, revealing that the keys were generated using predictable integers, making them easily recoverable. Major tech companies, including Google, Mozilla, Apple, and Microsoft, swiftly blocked the affected certificates, with Mozilla and Chrome implementing blocks on the same day. eMudhra has since revoked the compromised certificates and is investigating the incident. No evidence of exploitation has been reported, but the incident raises significant concerns about the integrity of digital trust infrastructure. The affected keys were generated in April 2025 and included both TLS and code-signing certificates. The incident is documented under CVE-2026-111943, with a CVSS score of 5.4, indicating a medium severity level. 36 sources 50

Extracted Entities

Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys

The full story

Extracted Entities

Companies (9)

Countries (1)

Domains (1)

Platforms (2)

Tools (1)