eMudhra
On October 17, 2026, a researcher reported that the private keys of eight eMudhra intermediate certificate authorities were compromised — keys so weak that one of them was the number 4. Browsers blocked them within hours; the long tail was every server, container, and bundled library that kept trusting them. A week later, eMudhra exited the global certificate business entirely.
Skills for emudhra
Three original skills distilled from the incident — auditing every certificate chain you trust, drilling trust-store updates before a real incident, and responding in the first 24 hours when a CA you trusted falls.
Security
Certificate Inventory Audit
Find every certificate you trust — before someone else's compromise finds it
Security
Trust-Store Update Drill
Practice updating every trust store — so a real CA incident is routine
Security
CA Incident Response Playbook
A CA you trusted is compromised — what to do in the first 24 hours
Case studies: emudhra
Real-world case studies. Original summaries by AI Services Market — each links to the skills it demonstrates.
Eight Keys, One Flawed Script
On October 17, 2026, a researcher known only as Wayne told the Chrome Root Program that the private keys of eight eMudhra intermediate CAs w…
Read case → 2
Blocked in Hours — Everywhere Except the Long Tail
The browser response was a model of speed: Chrome blocked the six TLS intermediates about 100 minutes after the report, Mozilla's OneCRL blo…
Read case → 3
The Exit: A CA Leaves the Business It Broke
Five days after the disclosure, eMudhra's board voted to exit the global SSL/TLS business entirely — a segment worth about 1% of its global …
Read case →emudhra: questions, answered
Facts first — and the skill each question points to.
What is eMudhra?
An Indian digital trust company (emSign brand) and licensed Certifying Authority that issues digital-signature and website-security certificates. Its global SSL/TLS business — the segment hit by the October 2026 incident — contributed about 1% of its global revenue.
What exactly was compromised?
The private keys of eight eMudhra intermediate CA certificates: six that issued TLS (website) certificates and two that issued code-signing certificates. An attacker with any one key could issue certificates browsers accept for any domain, or sign software as a legitimate publisher.
How did the keys get so weak?
A flawed key-generation script at an April 2025 key ceremony produced P-384 keys with insufficient randomness. Some key values were tiny — 4, 56, 115 — so the keys could be recovered from the public certificates themselves, in under a second by one researcher's account.
When was it discovered, and by whom?
On October 17, 2026, a researcher credited as Wayne reported the keys to the Chrome Root Program, proving compromise by signing a message with each key. Mozilla independently recovered all eight keys the same evening, confirming the flaw was trivially exploitable.
How fast did browsers respond?
Chrome blocked the six TLS intermediates about 100 minutes after the report (CRLSet, 19:45 UTC October 17); Mozilla's OneCRL block landed at 22:59 UTC the same day; Apple on October 19; Microsoft on October 20. That speed is the standard your own systems should be measured against: Trust-Store Update Drill.
Am I safe if my browser updated?
In a browser, yes — but browsers were never the whole risk. Go programs, Python apps using certifi, Node services, container images, and appliances that do not consume revocation data or enforce Certificate Transparency kept trusting the compromised chains until their own updates. Inventory yours: Certificate Inventory Audit.
Were any fraudulent certificates actually issued?
Chrome found no TLS certificate chaining to the six affected intermediates in Certificate Transparency logs before its block, so none could have been trusted by default in CT-enforcing browsers. That does not rule out attacks on clients that skip CT — and the keys were public-recoverable, so treat them as available to everyone.
What did India's government do?
CERT-In issued advisory CIAD-2026-0050 on October 21, urging browser/OS updates and certificate replacement, and the Ministry of Electronics and IT formed a special investigation team. CERT-In also warned that legitimate sites could face disruption from the root removal.
What happened to eMudhra afterwards?
On October 22, 2026, its board exited the global SSL/TLS business, citing the incident, data-sovereignty requirements, complexity, and free competitors. Its shares fell about 20% to a 52-week low the same week, and Chrome removed the emSign ECC Root CA – G3 on October 27, 2026 — a hard deadline for replacing any legitimate chain to that root.
What should I do if I run a website or service?
First, check whether any chain you run passes through the affected intermediates or the emSign ECC Root CA – G3, and replace it with a certificate from an unaffected CA before the root-removal deadline bites. Then build the inventory and the drill so the next CA incident is routine: Certificate Inventory Audit, Trust-Store Update Drill, CA Incident Response Playbook.
Inspired by the eMudhra CA incident (October 2026). Summaries are our own; facts from CERT-In, Mozilla, Chrome, and public reporting.