Press play to start listening
Indian digital trust company eMudhra plans to leave the global SSL/TLS certificate market after eight of its intermediate certificate authorities were found to have easily guessable private keys.
The issue was reported on October 17, 2026, by a researcher identified as Wayne, who reported it to Mozilla. Mozilla independently recovered the keys, and security researcher Scott Helme later demonstrated the weakness in a public analysis, recovering all eight in less than a second. The keys were generated as small numbers rather than the large, unpredictable values expected for cryptographic security, and were created in April 2025.
“The eight intermediates are six TLS issuing CAs (DV, OV and EV, two generations each) and two code-signing CAs, all created in April 2025. Every one of them was also cross-signed by Sectigo’s AAA Certificate Services root in May 2025,” Helme explained in his blog post.
eMudhra has attributed the incident to a flaw in its key-generation process and said it is investigating the root cause. Its global SSL/TLS business accounts for roughly 1% of its revenue. The company cited rising compliance costs and data sovereignty requirements as reasons for its exit, while Chairman V Srinivasan described the public scrutiny as disproportionate to the division’s overall importance.
Browsers Withdraw Trust From Affected Certificates
Mozilla blocked the affected intermediates through OneCRL and subsequently moved to remove trust in emSign ECC Root CA – G3, the root certificate that signed them. Google has scheduled the removal from Chrome’s Root Store for October 27. Chrome and Firefox had already blocked the six affected TLS intermediates.
According to Google’s public Certificate Transparency records, no TLS certificates chaining to the six affected website-signing intermediates appeared in the logs before they were blocked. However, approximately 30,800 unexpired certificates chained to the broader root hierarchy as of October 21. These were not necessarily issued using the compromised keys.
eMudhra stated that seven of the eight intermediates had never been used in production, while the remaining one had not issued any end-entity certificates.
Earlier Warning Signs
eMudhra is offering free replacement certificates through partners and has committed to maintaining certificate revocation and status services until its issued certificates expire or are replaced.
The incident also raises questions about earlier certificate-management issues. Mozilla’s public incident record shows that eMudhra published invalid certificate revocation lists (CRLs) in May 2025 for six intermediate authorities.
In its current incident investigation, Mozilla questioned why the earlier investigation did not identify that multiple key pairs had been generated for the affected authorities.
The latest incident also has implications beyond browsers. Java keystores, container images, load balancers and mutual TLS configurations may maintain separate trust stores. Java does not check certificate revocation by default, so unpatched environments may continue accepting forged certificates if they still trust the affected chain.
In an October 22 statement, Java platform provider Azul confirmed that it had released updated Azul Zulu Builds of OpenJDK and Azul Prime versions that block the eight compromised certificates. The updates add the certificates to the Java runtime’s blocklist, without requiring manual changes after installation. Azul also published workaround instructions for environments that cannot be updated immediately.
Security teams should review certificate dependencies beyond browsers, apply relevant vendor updates and migrate critical services to an independent, trusted certificate authority where necessary.
