Eight intermediate certificate authority keys linked to eMudhra’s global website-security business were found to be dangerously weak, raising concerns about the systems that browsers use to establish trust online.
The flaw could have enabled attackers to create fraudulent HTTPS certificates and impersonate legitimate websites. The keys were generated on April 30, 2025, but the weakness remained undetected for about 18 months, according to eMudhra’s statement on October 21, 2026.
A certificate authority (CA) verifies identities and issues digital certificates. Intermediate authorities operate under a root certificate trusted by browsers and operating systems.
eMudhra said a key-wrap/unwrap step during its key-generation procedure produced a second, weak set of keys, which were subsequently published to browser root stores. Although the company added its root private key was not compromised, browser operators have withdrawn trust from the associated emSign ECC Root CA - G3 as a precaution.
Google’s Chrome Security team warned that the flaw was “enabling anyone to forge trusted HTTPS certificates to impersonate any website against clients that have not yet removed trust in those CAs.” Google blocked the affected keys and plans to remove the parent root from Chrome’s trust store from October 27, Pacific time. Some legitimate websites using certificates under that root may consequently stop functioning in Chrome.
Mozilla, meanwhile, blocked the affected certificates in Firefox within three hours of receiving the report and released software updates to extend protection to users who might not receive automatic safeguards.
The immediate impact appears limited, although the investigation remains ongoing.
eMudhra said none of the eight affected intermediate authorities issued end-user certificates, its infrastructure was not compromised and no data was breached. It identifies one affected customer ecosystem in the United States, where certificates are being replaced.
The company stated its Indian digital-signature and eSign services, which operate on separate infrastructure, remain unaffected. It acknowledged uncertainty over the cause, noting, “We have not yet confirmed the exact root cause. We will publish it in full once our investigation is complete.”
The incident highlights a wider challenge for the digital-trust industry. Encryption can protect communications, but only when the certificates establishing a website’s identity are reliable. Browser companies therefore maintain their own trusted certificate lists and can revoke acceptance when a provider’s controls fail.
Public Certificate Transparency logs also help detect suspicious certificate issuance. The uncomfortable question for eMudhra is how a weakness of this significance escaped detection through two audit cycles.
The company said it is reviewing its key-generation procedures and offering enterprise customers certificates from an additional certificate authority to reduce dependence on a single trust chain.