eMudhra CA Certificates Compromised: CERT-In Advisory

Source: CERT-In advisory CIAD-2026-0050 • Date: 21 October 2026 (updated 26 October 2026)

CERT-In says eight eMudhra intermediate CA certificates were revoked on 18 October 2026 after their private keys were found to be weak, and Google’s removal of the emSign ECC Root CA – G3 is expected to reach Chrome devices on 27 October 2026.

eMudhra CA certificates: what happened

Private keys for the affected intermediate CAs were generated with insufficient randomness, so the P-384 keys could be recovered from their public keys almost instantly.
eMudhra attributes this to a flaw in its key generation ceremony, which produced a second set of weak keys; the weak ones were published to browser root stores.
The P-384 algorithm itself is not considered flawed.
eMudhra says none of the affected intermediates issued end-entity certificates and only one was deployed in production.

What has been blocked or removed

Eight eMudhra intermediate CA certificates were revoked on 18 October 2026.
Six TLS intermediates were blocked by Mozilla (OneCRL) and Google (Chrome CRLSet) on 17 October 2026.
Mozilla removed emSign ECC Root CA – G3 in NSS 3.131.1; Google announced its removal from the Chrome Root Store, expected to reach devices on 27 October 2026.
Not affected, per the advisory: eMudhra’s Indian Digital Signature Certificate (DSC) and eSign services regulated by the CCA.

Risk and what CERT-In advises

Anyone holding the recovered keys could issue fraudulent TLS or code-signing certificates. As of 21 October 2026, public disclosures do not confirm malicious use.
Install the latest Firefox, Firefox ESR, Chrome and Android security updates.
Check which of your certificates or services chain to the affected intermediates or the removed root, and replace them where they will no longer be trusted.
Review apps, containers, appliances and embedded systems that keep their own CA bundles.
Never bypass certificate warnings or switch off verification.

eMudhra CA certificates FAQ

What happened to the eMudhra CA certificates?

CERT-In says weak private keys let attackers recover the keys of eight intermediate CAs, which were revoked on 18 October 2026.

When does Chrome remove the emSign root?

Google’s removal of emSign ECC Root CA – G3 from the Chrome Root Store is expected to reach devices on 27 October 2026.

Are Indian DSC and eSign services affected?

No. CERT-In says the incident does not affect eMudhra’s CCA-regulated DSC and eSign services.

Last updated: 26 October 2026