eMudhra Intermediate CA Certificate Key Compromise

Severity: HIGH · Category: PKI / TLS · Status: Mitigation active as of 23 October 2026. HIGH is a 443 Labs advisory-priority classification, not an independently assigned CVSS rating.

Important distinction

This is a cryptographic certificate-authority security incident, not a confirmed data breach. eMudhra says its infrastructure and customer data were not breached; its India DSC and eSign operations are unaffected. [1, 2]

Incident summary

On 17 October 2026, a security researcher disclosed that private keys for eight eMudhra (emSign) intermediate Certificate Authorities (CAs)—six TLS and two code-signing—could be recovered because they were generated with extremely weak randomness. The keys originated in an April 2025 key-generation ceremony. An attacker could use a recovered CA key to create fraudulent certificates where clients still trust the affected chain. [1–4]

eMudhra revoked the eight intermediate CAs on 18 October. According to eMudhra, none of the eight issued end-entity certificates and the root CA private keys were not compromised. Public reporting has not established malicious exploitation of the weak keys as of this advisory. [1, 2]

Potential impact

• TLS impersonation — On clients that still accept compromised CA chains, a network-positioned attacker could present fraudulent HTTPS certificates and potentially read or alter traffic.
• Code-signing abuse — Compromised code-signing CA keys could support issuance of fraudulent code-signing certificates.
• Service disruption — Removal of emSign ECC Root CA - G3 from trust stores may break legitimate TLS connections that chain to that root, even when those leaf certificates were not issued by the compromised intermediates. [1, 3]

Priority actions for customers

1. Inventory certificate chains

Identify websites, load balancers, APIs and mTLS services using the emSign ECC Root CA - G3 chain or affected emSign intermediate CAs. Include externally supplied services.

2. Replace affected TLS certificates

Where certificates rely on the distrusted G3 root, migrate to a valid, independently trusted CA hierarchy before client distrust changes reach your users.

3. Patch trust stores and software

Apply vendor browser, OS, runtime, appliance and container updates. Review software with its own CA bundle; redeploy where needed.

4. Validate and monitor

Confirm affected chains are rejected, monitor certificate-transparency activity, and do not bypass TLS warnings or disable certificate verification. [1, 3, 5]

Scope note: This advisory does not recommend a blanket DSC replacement or password reset solely because of this incident. Prioritize evidence-based certificate-chain and trust-store checks.

Technical information

• Root cause / weakness: P-384 EC private keys with values smaller than 256; weakness in key generation, not in the P-384 algorithm. eMudhra attributes this to a wrap/unwrap step; full root-cause investigation remains open.
• Affected CAs: Eight intermediate CA key pairs: six TLS-issuing and two code-signing CAs, in G3B/G3C series.
• Related trust anchor: emSign ECC Root CA - G3 (root key not reported compromised; root distrusted to reduce ecosystem risk).
• CVE / CVSS: No single incident-specific CVE or independently assigned CVSS rating; HIGH is a 443 Labs advisory-priority classification.
• Exploitation status: Recoverability independently verified; no confirmed malicious exploitation identified in sources reviewed as of 23 October 2026.
• Indicators (IOCs): No verified exploitation-specific IP addresses, domains or hashes published in the referenced official disclosures.

Incident response timeline

• 30 April 2025 — Affected keys created during eMudhra key-generation ceremony.
• 17 October 2026 — Researcher alerts browser root programs; Chrome and Firefox block vulnerable TLS intermediates.
• 18 October 2026 — eMudhra revokes all eight affected intermediate CAs.
• 20–21 October 2026 — Google, Mozilla and CERT-In publish technical/security advisories.
• 22 October 2026 — eMudhra announces its decision to exit the global SSL/TLS certificate business; replacement support planned. [6]
• 27 October 2026 (scheduled) — Chrome Root Store removal of emSign ECC Root CA - G3 expected to reach general channels. Scheduled date announced by Google as of 20 October 2026. [3]

Validation checklist

Advisory basis

Based on publicly available information as of 23 October 2026. This is an independent 443 Labs customer awareness advisory, not a notice of compromise of any recipient environment. Severity reflects potential impact where unpatched certificate trust persists. Review applicability with your infrastructure and service providers.