# eMudhra certificate authority security compromise

> Live situation record from CLSTR: https://clstr.news/situations/emudhra-certificate-authority-security-compromise
> Updated: 2026-10-22T20:17:52.000Z. Sources: 48. Developments: 3.

Security researchers discovered that eight intermediate certificates issued by the Indian certificate authority eMudhra were compromised due to extremely weak P-384 elliptic-curve private keys. The keys were found to be integers smaller than 256 rather than large random numbers, allowing attackers to recalculate them almost instantly to forge certificates and impersonate servers.

Major technology companies responded by blocking the affected certificates. Google, Apple, Microsoft, and Mozilla implemented various mitigation steps between October 17 and October 20. Mozilla also moved to remove the eMudhra root from its trust store. Mozilla released Firefox 158.0.1 to bundle the revocation directly into the browser, and Zen Browser released version 1.23.4b to incorporate similar protections.

While web browsers have largely mitigated the risk, experts warn that software environments such as Python, Node.js, and Go, as well as IoT devices, may remain vulnerable because they often rely on static trust stores without real-time revocation checks. Blockchain security firm CertiK specifically noted that cryptocurrency trading bots and exchange-linked applications may be at risk of traffic interception.

eMudhra has attributed the vulnerability to a bug in a key configuration script used during a ceremony in April 2025, noting that the incident involved human error during the packaging process. In response, the Indian Ministry of Electronics and Information Technology has formed a special team to investigate the incident, though it clarified that regulated digital signature services in India remain unaffected. Following the news, eMudhra’s shares experienced a significant decline. 

In a major strategic shift following the incident, eMudhra announced its decision to exit the global SSL/TLS certificate market, citing high operational complexity, rising compliance costs, and declining commercial viability due to competition from free certificate providers.

## Claims

- Eight eMudhra intermediate certificates were compromised due to weak private keys. (corroborated by 28 sources)
- The compromised P-384 private keys were integers less than 256. (corroborated by 16 sources)
- Google Chrome blocked the affected certificates on October 17. (corroborated by 14 sources)
- Apple blocked the certificates on October 19. (corroborated by 12 sources)
- Microsoft blocked the certificates on October 20. (corroborated by 9 sources)
- eMudhra attributed the issue to a bug in a key configuration script. (corroborated by 6 sources)
- Cloudflare released updates for Cloudflare One Clients and Cloudflare Tunnel. (corroborated by 2 sources)
- Ubuntu released updates to the system PKI root CA store in the ca-certificates package. (corroborated by 2 sources)

## Timeline

### 2026-10-22: eMudhra exits global SSL/TLS certificate business after security flaw

eMudhra is exiting the global SSL/TLS certificate business after discovering eight intermediate certificates with trivially recoverable private keys, prompting blocks by major browser vendors.

16 sources. https://clstr.news/cluster/emudhra-exits-tls-business-following-security-breach

### 2026-10-21: Mozilla and Zen Browser release security updates for eMudhra certificate compromise

Mozilla and Zen Browser have issued critical security updates to protect users against a certificate authority compromise by eMudhra that could allow attackers to impersonate websites.

2 sources. https://clstr.news/cluster/mozilla-and-zen-browser-release-security-updates-for-emudhra-certificate-compromise

### 2026-10-20: eMudhra certificate flaw triggers global security response

Weak private keys in eight eMudhra intermediate certificates have forced Google, Apple, and Mozilla to issue emergency blocks to prevent website impersonation and traffic interception.

34 sources. https://clstr.news/cluster/emudhra-certificate-authority-compromise-triggers-emergency-browser-blocks

---
Cite as: eMudhra certificate authority security compromise. CLSTR, https://clstr.news/situations/emudhra-certificate-authority-security-compromise