Browsers distrust an eMudhra root after weak CA keys; MeitY probes, DSC and eSign unaffected

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Eight eMudhra intermediate certificate keys were weak enough for anyone to work out. Browsers blocked them and dropped the root above them; CERT-In issued an advisory and MeitY set up a probe. What it means for websites, firms and DSC users.

01 / What happened

On 17 October 2026 a researcher told browser makers that the private keys of eight eMudhra intermediate certificate authority (CA) certificates could be worked out from their public keys. CERT-In's advisory CIAD-2026-0050 of 21 October says the keys were generated with too little randomness and could be recovered almost instantly. Six were for website (TLS) certificates and two for code signing.

• Mozilla and Google blocked the six TLS intermediates on 17 October; eMudhra revoked all eight on 18 October, CERT-In says.
• Mozilla removed the root above them, emSign ECC Root CA - G3, from Firefox. Google announced its removal from the Chrome Root Store, due to reach devices on 27 October.
• eMudhra blames a flaw in its April 2025 key generation ceremony, and says there was no infrastructure compromise or data breach.

02 / Why it matters

A certificate authority vouches that a website or app is genuine, and browsers trust whatever the CAs on their list sign. Anyone with these keys could have issued a trusted certificate for a site they don't control, or made malware look properly signed. The keys were not stolen; they were weak.

Ordinary users get the fix through browser and phone updates. Organisations with certificates that chain to the dropped root need new ones from another CA. DSC and eSign: CERT-In says eMudhra's digital signature certificates and eSign, regulated by the Controller of Certifying Authorities, are separate and not affected. If you sign filings with an eMudhra DSC, nothing changes.

03 / Confirmed vs. claimed

Confirmed (CERT-In, eMudhra): the weak keys, the blocks, the revocation, the root removals, and that DSC and eSign are unaffected. Per both, none of the eight had issued customer certificates, and as of 21 October there was no confirmed malicious use. Reported: MeitY has set up a special team to investigate and called the impact on Indian websites and apps very limited (DD India, News On AIR; we found no PIB release). Inc42 and Help Net Security report that eMudhra will wind down its global TLS certificate business and move about 30,000 customer certificates to other providers free of charge; we have not seen the exchange filing. Some outlets say browsers blocked all eight intermediates; CERT-In says six, as the other two are for code signing.

04 / What to do

• Everyone: update your browser, phone and computer. Never click past a 'connection is not private' warning on a banking, shopping or government site. A padlock only means the connection is encrypted, as our safe shopping guide explains.
• IT teams: find certificates chaining to emSign ECC Root CA - G3 or the affected intermediates and replace them from an unaffected CA. CERT-In also says to check devices and apps with their own certificate bundles and to watch Certificate Transparency logs for your domains.
• DSC and eSign users: no action needed. Be wary of calls asking you to 'renew' your DSC because of this; renew only through your provider's official site.