[CLSTR]
< Back to situation

[REVISION HISTORY]

eMudhra certificate authority security compromise

Updated 5 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-22 18:52 UTC → 2026-10-23 10:33 UTC · added removed

Security researchers discovered that eight intermediate certificates issued by the Indian certificate authority eMudhra were compromised due to extremely weak P-384 elliptic-curve private keys. The keys were found to be integers smaller than 256 rather than large random numbers, allowing attackers to recalculate them almost instantly to forge certificates and impersonate servers. Major technology companies responded by blocking the affected certificates. Google, Apple, Microsoft, and Mozilla implemented various mitigation steps between October 17 and October 20. Mozilla also moved to remove the eMudhra root from its trust store. Mozilla released Firefox 158.0.1 to bundle the revocation directly into the browser, and Zen Browser released version 1.23.4b to incorporate similar protections. While web browsers have largely mitigated the risk, experts warn that software environments such as Python, Node.js, and Go, as well as IoT devices, may remain vulnerable because they often rely on static trust stores without real-time revocation checks. Blockchain security firm CertiK specifically noted that cryptocurrency trading bots and exchange-linked applications may be at risk of traffic interception. eMudhra has attributed the vulnerability to a bug in a key configuration script used during a ceremony in April 2025. 2025, noting that the incident involved human error during the packaging process. In response, the Indian Ministry of Electronics and Information Technology has formed a special team to investigate the incident, though it clarified that regulated digital signature services in India remain unaffected. Following the news, eMudhra’s shares experienced a significant decline. In a major strategic shift following the incident, eMudhra announced its decision to exit the global SSL/TLS certificate market, citing high operational complexity complexity, rising compliance costs, and reputational risks. declining commercial viability due to competition from free certificate providers.

Versions

  1. 2026-10-23 10:33 UTC eMudhra certificate authority security compromise
  2. 2026-10-22 18:52 UTC eMudhra certificate authority security compromise
  3. 2026-10-22 07:27 UTC eMudhra certificate authority security compromise
  4. 2026-10-21 16:12 UTC eMudhra certificate authority security compromise
  5. 2026-10-21 16:10 UTC eMudhra certificate authority security compromise
  6. 2026-10-21 15:56 UTC eMudhra certificate authority security compromise

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.