Last updated: 22 October 2026. This is a developing story, and we will update this page as new information is confirmed.
The eMudhra private key compromise has become one of the most serious trust incidents in India’s PKI industry. If you use SSL certificates, digital signature certificates (DSC) or run a website, you probably have questions. This guide explains what happened in plain language and what you should do next.
What is the eMudhra private key compromise?
Browser makers have confirmed that the private keys of eight eMudhra intermediate CA certificates were compromised. These certificates sit between a trusted root and the certificates issued to customers. Researchers found the keys were so weak that they could be recovered from the public certificates in under a second (Scott Helme’s analysis).
In simple terms, the eMudhra private key compromise means someone holding such a key could, in theory, create a fake certificate for any website that browsers would trust (Cloudflare’s explanation).
Why the eMudhra private key compromise is so dangerous
Every certificate authority (CA) has a private key, and the whole system of trust depends on that key staying secret and unpredictable. A strong key is a random number so large that nobody could ever guess it. Here, researchers found keys that were tiny numbers, small enough to be worked out almost instantly.
Think of a bank vault whose combination is “1-2-3”. The vault looks solid, but anyone can open it. When a CA key is that weak, an attacker could sign a fake website certificate, and browsers would treat it as genuine. That is why the eMudhra private key compromise triggered emergency action from every major browser, even though no misuse has been confirmed.
8 critical facts about the incident
- Reported on 17 October 2026. A researcher alerted the browser root programs and eMudhra.
- Eight intermediate certificates are affected. These are CA certificates, not individual customer certificates.
- Browsers acted within hours to days. Chrome and Firefox blocked the certificates first, then Apple and Microsoft.
- The issuing root was removed. Mozilla removed emSign ECC Root CA – G3, and Chrome has announced it will do the same.
- eMudhra revoked the eight certificates.
- eMudhra says the impact is limited. It states that its root keys and other intermediates are unaffected, only one of the eight was in production, and none issued any end-entity certificate.
- The company blames a flawed key ceremony. eMudhra attributes the problem to a faulty script and human error during an April 2025 key generation process.
- Exploitation is unknown. Researchers say it is not known whether attackers abused the flaw (disclosure site).
eMudhra private key compromise timeline
- 17 October: A researcher reports the problem. Chrome and Firefox block the certificates within hours.
- 19 October: Apple adds its block, and Cloudflare begins its response.
- 20 October: Microsoft adds protection, Mozilla makes the incident public, and eMudhra posts a statement (The Register’s report).
- 21 October: eMudhra files a press release with the stock exchange blaming a flawed key generation ceremony.
- 27 October (scheduled): Chrome is due to remove the affected root from its root store.
Does the eMudhra private key compromise affect my DSC?
The eMudhra private key compromise concerns CA certificates in the browser trust chain (SSL/TLS). Based on public reports so far, nothing links it to the DSC tokens used for GST, MCA, Income Tax or e-tendering. Still, confirm with your certifying authority, and keep your token PIN private. We will update this section if eMudhra or the Controller of Certifying Authorities (CCA) publishes new guidance. For background, read our guide to the digital signature certificate.
What should website owners do after the eMudhra private key compromise?
- Update your browsers, operating systems and server software. Fixes are shipping through updates.
- Check which CA issued your SSL certificate by viewing the certificate chain in your browser.
- Keep an inventory of all your certificates, issuers and expiry dates.
- Plan an exit. Be ready to reissue your certificate from another CA quickly.
- Protect your private keys. Store them on hardware tokens or secure modules, never in plain files or emails.
- Monitor your domains for unexpected certificates using certificate transparency tools.
How Rannlab protects its customers
The eMudhra private key compromise came down to weak key generation, so key strength and key handling are where we focus our own security.
Strong key lengths. Every certificate we issue uses a minimum 2048-bit key, and where the use case and platform support it, we use 4096-bit keys. These sizes align with the key-strength guidance in NIST SP 800-57, FIPS 186-4 and the CA/Browser Forum Baseline Requirements, which treat 2048-bit RSA as the minimum acceptable strength.
Safe private key storage. Private keys are stored server-side in our secured environment, so they are not left scattered across emails, desktops and shared folders.
CertVault, our certificate and key management utility. We launched CertVault so you can manage your certificates and their keys in one place and keep them stored safely. It is quick to download and easy to use. With CertVault you can:
- see all your certificates and their expiry dates in one view,
- keep your keys protected instead of spread across files and inboxes,
- find and reissue a certificate fast if a problem like this ever affects your CA.
Download CertVault today, or book a free certificate chain check with our team.
What does this mean for Indian businesses?
The eMudhra private key compromise is a reminder that India’s digital economy runs on trust. Online filings, e-commerce checkouts, banking portals and government services all depend on certificates.
Two points are worth remembering. First, browser vendors acted fast, so most up-to-date users are already protected. Second, no business should depend blindly on a single CA. Companies that track their certificates and can reissue them quickly will recover from incidents like this in hours, not days.
If you run an online store, a company portal or an application on AWS or Azure, now is a good time to review your certificate setup and key storage. See our cloud and server setup services for help.
Need help after the eMudhra private key compromise?
If this incident has you worried about your certificates, Rannlab can review your setup, replace affected certificates and secure your servers.
Frequently asked questions
Was my website hacked because of the eMudhra private key compromise?
Not necessarily. The risk is that fake certificates could be created, and no exploitation has been confirmed. Keeping your software updated is the best protection.
Do I need to replace my SSL certificate?
Only if it chains to one of the affected certificates. eMudhra states that none of the eight issued a customer certificate, but check your chain, or ask us to do it.
Is my DSC token safe to use?
No public report links the incident to DSC tokens used for GST, MCA or Income Tax filing. Verify with your CA.
Will browsers show warnings?
Updated browsers will reject certificates that chain to the blocked intermediates. Outdated browsers, devices and software may not be protected, so update them.
Which CA should I choose?
Choose a CA with a clean record and transparent practices, and keep the ability to switch if needed.
