eMudhra: compromised certificates and what to update

Eight intermediate certificates from the certificate authority eMudhra had guessable private keys; one was the number 4. Browsers have already blocked them, but other systems need to be updated.

On October 17, 2026, Mozilla was informed that the private keys of eight intermediate certificates from eMudhra, a certificate authority in India, were exposed. Six are used for HTTPS (TLS) websites and two for code signing. According to Cisco Talos, an error in the key generation ceremony of April 30, 2025, produced weak P-384 keys that can be deduced from small numbers. Researcher Scott Helme, who recovered the keys, showed that one of them was, literally, the number 4; the initial discovery was reported to the browsers and to eMudhra by another researcher.

Why it matters

Certificate authorities are the foundation of trust on the internet: they guarantee that the browser padlock truly belongs to the site you are visiting and that a program was signed by whoever claims to have signed it. With those keys, an attacker could issue certificates that systems would accept as valid. As of October 21, Talos had not detected any malicious use.

How browsers and vendors responded

Firefox blocked the certificates within three hours through its OneCRL revocation list and released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1. The NSS 3.131.1 library removes the root that signed them.
Chrome, Firefox and Apple blocked the certificates for websites, and Microsoft blocked the code signing ones.
In the Go language, the flaw was registered as CVE-2026-111943 and fixed in Go 1.27.3 and 1.26.10.
eMudhra revoked the certificates and stopped issuing under its G3 root.

Who is still exposed

Updated browsers are already protected. The risk remains in software that ships its own certificate store and does not rely on the operating system: VPN clients, proxies, network and IoT devices, continuous integration servers and applications compiled with an earlier version of Go.

What to update in your company

Update browsers and operating systems on all computers.
On servers, update the root certificate package (ca-certificates or NSS) and recompile Go applications with version 1.27.3 or 1.26.10.
Review proxies, VPN clients, gateways and IoT devices that have their own certificate store, and apply each vendor's updates.
If your company uses certificates issued by eMudhra, identify where they are installed and replace them.

October 31 update: root removed and eMudhra's exit

Mozilla and Chrome removed trust in the entire emSign ECC Root CA - G3 root, and on October 22 eMudhra announced that it is leaving the global SSL/TLS certificate business. If your site uses an eMudhra certificate, replace it with one from another certificate authority. We also checked this article against Scott Helme's analysis and the open Mozilla case, and clarified who recovered the keys.

How we help you

We manage SSL certificates, servers and updates as part of our infrastructure management service, and we review your systems' dependencies with our application development team.