# eMudhra — Skills & Case Studies

On October 17, 2026, a researcher reported that the private keys of eight eMudhra intermediate certificate authorities were compromised — keys so weak that one of them was the number 4. Browsers blocked them within hours; the long tail was every server, container, and bundled library that kept trusting them. A week later, eMudhra exited the global certificate business entirely.

## Skills

- Certificate Inventory Audit: Find every certificate you trust — before someone else's compromise finds it (https://aiservicesmarket.lol/skills/certificate-inventory-audit/)
- Trust-Store Update Drill: Practice updating every trust store — so a real CA incident is routine (https://aiservicesmarket.lol/skills/trust-store-update-drill/)
- CA Incident Response Playbook: A CA you trusted is compromised — what to do in the first 24 hours (https://aiservicesmarket.lol/skills/ca-incident-response-playbook/)

## Case studies

- Eight Keys, One Flawed Script: On October 17, 2026, a researcher known only as Wayne told the Chrome Root Program that the private keys of eight eMudhra intermediate CAs were compromised — and proved it by signing a message with each key. The cause was a flawed key-generation script at an April 2025 key ceremony that produced P-384 keys with almost no randomness. Mozilla independently recovered all eight keys the same day.
- Blocked in Hours — Everywhere Except the Long Tail: The browser response was a model of speed: Chrome blocked the six TLS intermediates about 100 minutes after the report, Mozilla's OneCRL block landed the same evening, Apple followed within two days, Microsoft within three. The incident's real lesson is the gap that speed exposed: everything that is not a browser — Go programs, Python apps, Node services, container images, appliances — kept trusting the compromised chains until its own update arrived.
- The Exit: A CA Leaves the Business It Broke: Five days after the disclosure, eMudhra's board voted to exit the global SSL/TLS business entirely — a segment worth about 1% of its global revenue, but the source of a government probe, a 20% share-price fall, and a permanent loss of trust. Chrome's removal of the emSign ECC Root CA – G3 on October 27 turned replacement from good practice into a deadline: legitimate certificates chaining to that root stopped working in Chrome.

## Frequently asked questions

### What is eMudhra?

An Indian digital trust company (emSign brand) and licensed Certifying Authority that issues digital-signature and website-security certificates. Its global SSL/TLS business — the segment hit by the October 2026 incident — contributed about 1% of its global revenue.

### What exactly was compromised?

The private keys of eight eMudhra intermediate CA certificates: six that issued TLS (website) certificates and two that issued code-signing certificates. An attacker with any one key could issue certificates browsers accept for any domain, or sign software as a legitimate publisher.

### How did the keys get so weak?

A flawed key-generation script at an April 2025 key ceremony produced P-384 keys with insufficient randomness. Some key values were tiny — 4, 56, 115 — so the keys could be recovered from the public certificates themselves, in under a second by one researcher's account.

### When was it discovered, and by whom?

On October 17, 2026, a researcher credited as Wayne reported the keys to the Chrome Root Program, proving compromise by signing a message with each key. Mozilla independently recovered all eight keys the same evening, confirming the flaw was trivially exploitable.

### How fast did browsers respond?

Chrome blocked the six TLS intermediates about 100 minutes after the report (CRLSet, 19:45 UTC October 17); Mozilla's OneCRL block landed at 22:59 UTC the same day; Apple on October 19; Microsoft on October 20. That speed is the standard your own systems should be measured against: Trust-Store Update Drill.

### Am I safe if my browser updated?

In a browser, yes — but browsers were never the whole risk. Go programs, Python apps using certifi, Node services, container images, and appliances that do not consume revocation data or enforce Certificate Transparency kept trusting the compromised chains until their own updates. Inventory yours: Certificate Inventory Audit.

### Were any fraudulent certificates actually issued?

Chrome found no TLS certificate chaining to the six affected intermediates in Certificate Transparency logs before its block, so none could have been trusted by default in CT-enforcing browsers. That does not rule out attacks on clients that skip CT — and the keys were public-recoverable, so treat them as available to everyone.

### What did India's government do?

CERT-In issued advisory CIAD-2026-0050 on October 21, urging browser/OS updates and certificate replacement, and the Ministry of Electronics and IT formed a special investigation team. CERT-In also warned that legitimate sites could face disruption from the root removal.

### What happened to eMudhra afterwards?

On October 22, 2026, its board exited the global SSL/TLS business, citing the incident, data-sovereignty requirements, complexity, and free competitors. Its shares fell about 20% to a 52-week low the same week, and Chrome removed the emSign ECC Root CA – G3 on October 27, 2026 — a hard deadline for replacing any legitimate chain to that root.

### What should I do if I run a website or service?

First, check whether any chain you run passes through the affected intermediates or the emSign ECC Root CA – G3, and replace it with a certificate from an unaffected CA before the root-removal deadline bites. Then build the inventory and the drill so the next CA incident is routine: Certificate Inventory Audit, Trust-Store Update Drill, CA Incident Response Playbook.

Part of the trending collections at https://aiservicesmarket.lol/trending/