In October 2026, researchers found that eight certificate authority keys run by Indian company eMudhra could be worked out from public data in under a second. Browsers blocked them within hours, and MeitY says the impact in India was limited. Here is what happened, what it affects, and what to check.
What happened
Every HTTPS website proves its identity with a certificate. Those certificates are signed by certificate authorities (CAs), and your browser trusts a CA only if it trusts the CA's keys. If someone gets a CA's private key, they can make fake certificates for any website.
The report. On 17 October 2026, a researcher reported to Google's Chrome Root Program and to Mozilla that the private keys for eight eMudhra intermediate CA certificates could be recovered from the public certificates. Mozilla said these keys "could allow attackers to issue fraudulent HTTPS certificates."
How weak were the keys? A proper P-384 key is a random 384-bit number. These keys were tiny numbers that fit in a single byte. Security researcher Scott Helme published all eight values: 4, 56, 66, 115, 155, 156, 230 and 237. The key for "EM OV TLS CA - G3C" was literally the number 4. Because each key had only 256 possible values, a computer could find it by trying at most 255 numbers.
Which certificates. Six of the eight intermediates were for website security (TLS) and two were for code signing. eMudhra says its root keys and other intermediates were not affected.
The cause, per eMudhra. The company says a flaw in a key-generation ceremony on 30 April 2025 created a second set of weak keys next to the intended strong ones, and the weak ones were used by mistake. It says its systems were not hacked and no data was breached. The full root-cause investigation is still going on.
Browser response. Chrome pushed a block on 17 October without needing a browser update. Android got the same block through Google Play Services. Mozilla, Apple and Microsoft also moved to distrust the certificates, and eMudhra revoked them.
Root removal. Google is also removing the "emSign ECC Root CA - G3" root from the Chrome Root Store. Google says this takes effect on Tuesday, 27 October 2026. It is also reviewing whether eMudhra's other CAs should stay trusted.
MeitY's statement. On 21 October, MeitY said it had taken "serious note", formed a special team to investigate, and said the impact on Indian websites and apps was "very limited and for a very short interval." It also warned against "fear mongering" on social media. It said the issue concerns eMudhra's global website-security business, not its regulated Digital Signature Certificate (DSC) and eSign services. CERT-In has issued an advisory.
Was anyone attacked? As of 21 October, there was no public evidence that the keys were used in an attack. Google said no certificates from the six TLS intermediates appeared in public Certificate Transparency logs before they were blocked. eMudhra says none of the eight had issued certificates to websites. Nobody can fully rule out misuse before the block, though.
Why it matters for you
If you just browse the web. Your browser is your main protection here, and it has already been updated. Chrome users got the block automatically. On Android, restarting your phone makes sure the Google Play Services update is active. Firefox, Safari and Edge users should install pending updates.
If you use a DSC or eSign. MeitY and eMudhra both say Indian DSC and eSign services run separately and are not affected. You do not need to do anything with your digital signature because of this incident.
If you run a website or app. Some legitimate certificates that chain to emSign ECC Root CA - G3 will stop working in Chrome after the root removal. Google has asked site owners to get a new TLS certificate from a different CA before then. If your certificate came from eMudhra, check now.
If you run servers, apps or IoT devices. Browsers block bad certificates, but many other programs do not check revocation by default. Helme's advice is to update operating system CA bundles and libraries (for example, Python's certifi package), and to rebuild container images once their base images are updated. Devices that cannot be updated may keep trusting these certificates until they expire.
The bigger lesson. One process mistake made eight trusted keys guessable. Browsers reacted fast, but that only protects you if your software is updated.
What to do now
Update your browser and phone. On Android, restart the device once.
Never click through a browser warning that says a site's certificate is not valid, especially on banking or payment pages.
Site owners: in Chrome, click the icon next to the address bar, then "Connection is secure" and "Certificate is valid". If the chain includes emSign ECC Root CA - G3, replace the certificate now. Ask your hosting provider if unsure.
CERT-In warned the code-signing keys could make malicious software look trusted. Only install software from official sources.
What to watch next
The outcome of MeitY's special team investigation, which it says it will share when complete.
eMudhra's full root-cause report.
Whether Google, Mozilla or Apple decide to stop trusting eMudhra's remaining CAs. Google says updates will be posted on the CCADB public list.
Good to know
This is general information, not a security audit of your systems. For official guidance, check CERT-In and your browser vendor.
Officials say DSC and eSign services were not affected, despite confusion on social media.
Facts here are current as of 26 October 2026. The story is still developing.
Sources
Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
Scott Helme: Eight bits of trust, eMudhra's CA keys cracked in milliseconds
The Register: eMudhra's private keys compromised, one of them was the number 4
Business Today: MeitY says impact very limited, DSC and eSign unaffected
BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
Found this useful? Follow @kevinsingh.me on Instagram for a new AI tool every day, and subscribe so you don't miss the next one.