he security of the internet depends on trust. When users visit a website over HTTPS, their browsers rely on digital certificates to verify the website’s identity and establish an encrypted connection. But what happens when the cryptographic keys behind trusted certificates are compromised?

A recent incident involving eMudhra, a digital trust service provider, has raised important questions about certificate security, cryptographic key generation, and the reliability of the Public Key Infrastructure (PKI).

What Happened in the eMudhra Incident?

On October 17, 2026, a security researcher reported that the private keys associated with eight eMudhra intermediate Certificate Authority (CA) certificates had been compromised. According to Google and Mozilla, the keys were generated with insufficient randomness, making them vulnerable to recovery.

Intermediate CA certificates play an important role in the certificate trust chain. They allow a certificate authority to issue digital certificates to websites and other entities. If an attacker obtains an intermediate CA's private key, they may be able to create fraudulent certificates that browsers could trust unless the affected certificate is blocked.

In this case, the weakness created the potential for attackers to impersonate websites and potentially intercept or modify communications with users.

However, eMudhra stated that the incident was limited to the specific affected intermediate certificates. The company also reported that none of these certificates had issued end-entity certificates, a claim it said was supported by its internal analysis and publicly available Certificate Transparency records. This distinction is important: compromised CA keys create a serious risk, but that does not automatically mean customer website certificates were fraudulently issued.

How Did Browser Vendors Respond?

Following the disclosure, browser security teams acted to reduce the risk. Mozilla blocked the affected certificates in Firefox through its OneCRL mechanism. Google also updated Chrome's certificate-blocking protections and announced plans to remove the associated emSign ECC Root CA - G3 from the Chrome Root Store, with the change expected to roll out on October 27, 2026.

These measures demonstrate how browser vendors and certificate authorities work together to protect the wider Web PKI ecosystem. However, applications, operating systems, embedded devices, and other software may rely on different trust stores or update mechanisms, so protection can vary.

What Can Website Owners and IT Teams Learn?

This incident highlights several practical lessons:

  • Review certificate chains: Identify the root and intermediate CAs used by your website certificates.
  • Monitor CA announcements: Follow official updates from browser vendors and certificate authorities.
  • Check compatibility: If your certificate chain relies on the affected root, contact your certificate provider to determine whether migration is necessary.
  • Strengthen key-generation practices: Cryptographic keys must be generated using secure, well-tested processes that provide sufficient randomness.
  • Prepare for certificate changes: Maintain an inventory of certificates and a renewal or replacement plan to reduce unexpected service interruptions.

Final Thoughts

The eMudhra incident is a reminder that HTTPS security depends on more than installing an SSL/TLS certificate. It also relies on secure key generation, responsible certificate issuance, effective monitoring, and timely responses to vulnerabilities.

For organizations, reviewing certificate dependencies and staying informed about trust-store changes can help reduce risk and prevent avoidable disruptions.

Read the full analysis: https://certera.com/blog/emudhra-certificate-compromise-8-weak-ca-keys-exposed/