The eMudhra security flaw has prompted Google and Mozilla to block compromised digital certificates. The incident involves eight eMudhra intermediate certification authority (CA) certificates and raises concerns about website security.
India’s cybersecurity agency CERT-In issued an advisory on October 21, 2026. The agency clarified that the incident affects eMudhra’s international web certificate operations. However, its regulated digital signature certificate and eSign services in India remain unaffected. CERT-In advisory
What caused the eMudhra security flaw?
The eMudhra security flaw traces back to a key-generation ceremony in April 2025. According to CERT-In, the affected private keys lacked sufficient cryptographic randomness. This weakness could allow attackers to recover the keys from their corresponding public keys.
Private keys play a vital role in digital certificate security. Attackers who obtain a certificate authority’s private key may create fraudulent certificates. These certificates could make malicious websites appear legitimate.
Attackers could potentially misuse the compromised eMudhra intermediate certificates to impersonate websites. Such activity could also undermine trust in encrypted internet connections.
Google and Mozilla block compromised certificates
Google and Mozilla responded after receiving reports of the compromised keys on October 17.
Google’s Chrome security team blocked the affected certificate keys through a security-list update. Chrome users received this protection without needing a browser update or restart.
Google also announced plans to remove the emSign ECC Root CA – G3 certificate from the Chrome Root Store. The company expects this change to roll out from October 27, 2026, Pacific time.
Mozilla also blocked the affected certificates in Firefox through its OneCRL revocation system. The company said users with standard configurations received protection on October 17.
Mozilla has also released additional Firefox security updates. These updates address configurations that may prevent users from receiving automatic protection.
Together, these measures aim to stop affected browsers and software from trusting the compromised certificates.
What does this mean for Indian internet users?
CERT-In clarified that the incident does not affect eMudhra’s digital signature certificate issuance or eSign services regulated by India’s Controller of Certifying Authorities.
The affected operation serves a different purpose. It issues certificates that browsers and operating systems trust to secure websites, software and online communications.
Google said Certificate Transparency logs showed no certificates chaining to six affected TLS-issuing intermediate certificates before its blocking action. This finding limits the evidence of exposure through those certificates in systems that enforce Certificate Transparency. However, it does not rule out every possible form of misuse.
Ordinary users should keep their browsers and devices updated. Website operators using certificates linked to the affected emSign root should also follow Google’s guidance. They may need to migrate to an unaffected certificate hierarchy before the planned root removal.
eMudhra continues its investigation
In a statement published on October 20, eMudhra said the incident involved specific intermediate certificates created during its April 2025 key-generation ceremony.
The company said its internal analysis and publicly available Certificate Transparency records showed that the affected intermediate authorities had not issued end-entity certificates.
eMudhra also said it had started incident-response procedures. The company was working with browser makers and root-store operators to contain the issue and protect users.
The incident highlights the importance of reliable cryptographic key generation and independent oversight. Google’s and Mozilla’s responses also demonstrate the role browser makers play in protecting internet users. The ongoing investigation should help clarify the cause of the failure and its implications for affected website operators.
