Indian digital trust company eMudhra is at the centre of one of the year's biggest internet security scares. Google, Mozilla, Apple and Microsoft have blocked eight of its intermediate certificate authority (CA) certificates after researchers found that the secret keys behind them were so weak they could be worked out from publicly available information. India's cyber security agency CERT-In issued an advisory on October 21, and the company says no customer data was lost.
If the words "certificate authority" sound abstract, here is why it matters: these certificates are what make the padlock appear in your browser. A compromised one could, in theory, let an attacker set up a fake website that browsers would treat as genuine.
What exactly went wrong
An intermediate CA is a link in the chain of trust that signs the certificates websites show to your browser. The private key for such a certificate must be impossible to guess. In eMudhra's case, a key-generation ceremony held in April 2025 produced a set of keys with too little randomness, according to technical disclosures by browser root programmes.
eMudhra said on October 21 that a flaw in a key "wrap/unwrap" step created these weak keys alongside the intended strong ones, and that the weak set ended up in the certificates submitted to browser trust stores. The full root cause is still being investigated. Crucially, the keys were not stolen from the company's systems – they could simply be calculated from the public certificates, and researchers have since shown this can be done very quickly.
How the tech giants responded
A security researcher reported the problem to browser makers on October 17. Google's Chrome team pushed out a block for the six website-related certificates the same evening, and Mozilla followed within hours for Firefox. Apple blocked the certificates on October 19, Android received a block through Google Play services, and Microsoft acted on October 20.
Mozilla has also removed the emSign ECC Root CA – G3 from its trusted list, and Google has said it plans to remove the same root from Chrome's trust store. A string of software projects, including the Go programming language, Node.js, Python's certifi package and several Linux distributions, have released updates as well.
The affected certificates at a glance
| Certificates affected | 8 eMudhra intermediate CAs |
| Website (TLS) certificates | 6 – DV, OV and EV, G3B and G3C |
| Code-signing certificates | 2 – EM OV CS CA G3B and G3C |
| Root involved | emSign ECC Root CA – G3 |
| Reported to browsers | October 17, 2026 |
| CERT-In advisory | October 21, 2026 (CIAD-2026-0050) |
| Confirmed misuse | None reported so far |
What eMudhra says
The company has revoked all eight certificates and says it is issuing replacements to affected customers. It maintains that its infrastructure was not breached, that its root keys and other intermediates are not affected, and that the problem is confined to its global website-security business, which it has described as a small part of its revenue. In a filing to the stock exchange, it also acknowledged reputational risk from the episode, and its shares came under heavy selling pressure in Wednesday's trade, according to market reports.
Most importantly for Indian users, eMudhra has said that its Indian Digital Signature Certificate (DSC) and eSign services – widely used for income tax filings, GST returns, company filings and online contracts – are not affected.
Should Indian users worry?
For ordinary users, the risk is low. CERT-In's advisory says public disclosures had not established any confirmed malicious use as of October 21, and browser blocks were in place before any website certificates linked to the six website intermediates had been publicly logged. Reports also say the Ministry of Electronics and Information Technology has set up a team to look into the matter, with officials describing the impact on Indian websites as limited.
Still, a few simple habits will keep you protected:
- Update your browser (Chrome, Firefox, Safari or Edge) and your phone or computer's operating system.
- Never click through a browser warning that says a site's security certificate is invalid.
- Avoid opening banking or government sites from links in SMS, email or WhatsApp – type the address yourself.
- If you run a website whose certificate chains to emSign ECC Root CA – G3, contact your provider and move to a replacement certificate.
- Developers should update and rebuild apps that check certificates, especially Go programs, as CERT-In has advised.
What happens next
Google's removal of the emSign root from Chrome is expected to reach users in the coming days, which could cause warnings on any legitimate site still using that chain. Browser makers are also reviewing the incident further, and their final decisions on eMudhra's other roots will shape how much of its global certificate business survives. For India's growing digital ecosystem, the episode is a reminder that trust online depends on getting even the smallest technical step right.
Comments (0)