eMudhra exits the global SSL/TLS certificate business: what certificate holders should do now

Indian certificate authority eMudhra has announced that it will leave the global SSL/TLS certificate market. Its board made the decision on Thursday, 22 October 2026. Five days earlier, a security researcher showed that the private keys of eight eMudhra intermediate CA certificates could be recovered almost instantly.

What happened

On 17 October, the researcher reported the problem to Apple, Google, Microsoft, Mozilla and eMudhra. A CA private key should be a very large random number. Each of these eight keys was smaller than 256, so anyone could calculate it in moments.

Six of the eight intermediates were used for website (TLS) certificates. Chrome and Firefox blocked those six within hours. Google says no website certificate issued from them had appeared in Certificate Transparency (CT) logs before the block. eMudhra says it never used the eight intermediates to issue certificates and that its systems were not breached.

The browsers then went further:

• Mozilla decided on 20 October to stop trusting the root above those intermediates, emSign ECC Root CA - G3, in Firefox.
• Google Chrome will also distrust that root. The change is expected to reach users on the morning of 27 October 2026 (US Pacific time).

When a browser removes a root, it also stops trusting every legitimate certificate issued under it. According to Chrome's count of public CT logs, about 30,800 unexpired certificates (counted as precertificates in CT logs) chained to the G3 ECC root on 21 October. Almost all of them (99.9%) were issued through InCommon, the certificate service used by many US universities, which moved onto eMudhra's CertiNext platform earlier this year. Google has told affected website operators that they must immediately get and install a new TLS certificate from another hierarchy included in the Chrome Root Store.

eMudhra's plan

• eMudhra says it will replace affected certificates at no cost with certificates from partner CAs. It has not named those partners or set a date for its exit.
• Until the move is complete, its separate emSign Root CA - G1 (RSA) hierarchy will keep serving customers. Mozilla is not removing that root for now. Chrome has asked eMudhra whether its other roots are affected and has not yet announced a decision on them.
• Revocation and status services (CRL/OCSP) will keep running until every SSL/TLS certificate eMudhra issued has expired or been replaced.
• Its other businesses, including digital signature certificates, eSign and the CertiNext platform, will continue.

eMudhra says the global SSL/TLS business is only about 1% of its revenue. The company said this business has become costly to run under data sovereignty and compliance rules, and that some large providers offer these certificates for free.

Open questions about the RSA root

The questions do not end with the ECC root. In Mozilla's public bug report, the researcher noted that a certificate revocation list (CRL) eMudhra published on 14 October for emSign Root TLS CA - G1 does not verify against that CA's own key. Another participant said the list seems to have been signed with an eMudhra OCSP key by mistake, rather than with another weak key.

eMudhra had published invalid CRLs for six of the same intermediates in 2025. It has now told Mozilla that those lists were later re-signed with the flawed keys found this month. Chrome said this disclosure "raises serious concerns" about eMudhra's transparency and incident handling. Chrome has also posted 12 questions to eMudhra in the bug report, and as of 22 October they had not been answered publicly.

Our recommendation for eMudhra certificate holders

If your website, API or internal service uses an SSL/TLS certificate issued by eMudhra (emSign), plan to move to another certificate authority now. Do not wait for the 27 October Chrome change or for the final decision on the G1 RSA root.

1. Find your eMudhra certificates. Check the issuer of each certificate on your servers, load balancers and CDNs. Look for "emSign" or "eMudhra" in the certificate chain.
2. Replace ECC (G3) certificates first. Chrome and Firefox will reject these, so visitors will see security warnings.
3. Treat RSA (G1) certificates as temporary. They still work today, but their root could also be distrusted. Moving them early avoids a second emergency.
4. Check your ACME automation. Standard ACME clients do not replace a certificate before its renewal window unless they support ACME Renewal Information (ARI). You may need to trigger the renewal by hand and update the CA directory URL in your client settings.
5. Test after you switch. Make sure the full new chain is installed and test with several browsers and devices.

One Sign can help. We supply GlobalSign SSL/TLS certificates, a publicly trusted CA hierarchy that is not linked to eMudhra. Our team can help you plan and complete the move, from choosing the right certificate type to installing and testing it. Email sales@onesign.sg or call +65 3107 1270 to discuss your migration.

Source: The Hacker News: "eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable" (22 October 2026).