Updated November 3, 2026

In October, researchers reported that the private keys for eight eMudhra intermediate certificate authorities (CAs) were recoverable because of weak key generation. Six were used for TLS and two for code signing. If abused, the keys could have been used to create certificates impersonating websites or software publishers.

Browser and platform vendors responded by blocking the affected keys and changing their trust lists. Google blocked the affected intermediates in Chrome and removed the related emSign ECC Root CA – G3 from Chrome’s root store. Mozilla blocked them in Firefox and updated its trust store. Microsoft updated Windows and Edge trust lists.

The scope needs context. Google reported that no TLS certificates chaining to the six affected intermediates appeared in Certificate Transparency logs before its blocking action. eMudhra said the affected intermediates had not issued end-entity certificates, while distrust of the related ECC root affected one customer ecosystem. This does not mean every eMudhra certificate or website was affected. Site and IT administrators should verify their own certificate chains and the trust stores their systems use.

What website and IT teams should check

• Inventory certificate chains. Check the issuer and full chain for websites, APIs, mail gateways, VPN portals, and load balancers. If a service relies on an affected or distrusted chain, arrange a replacement certificate from a currently trusted CA.
• Look beyond browsers. Review containers, Java runtimes, appliances, monitoring agents, older operating systems, and embedded clients. They may use bundled trust stores or miss browser revocation updates.
• Keep updates flowing. Update operating systems, browsers, mobile devices, CA bundles, and application dependencies. Pay special attention to disconnected or long-lived systems.
• Avoid restoring trust as a quick fix. Microsoft warns that manually restoring removed certificates can leave some software trusting certificates tied to compromised intermediates. Check the specific dependency and move it to a valid chain.
• Track certificate ownership. Record issuers, expiry dates, renewal owners, and dependent services. For critical services, consider testing an alternative CA path in advance.

Trust updates reach browsers, operating systems, libraries, and appliances on different schedules. A valid certificate in a current browser does not confirm that every backend client has the same protection. Certificate inventory and renewal checks belong in incident response.

Primary sources

• Google: Protecting Chrome and Android users
• Mozilla: Protecting Firefox users
• Microsoft: Response and customer actions
• eMudhra: Incident updates