eMudhra certificates blocked by Google and Mozilla; some legitimate websites may stop working from October 27; here's what happened

Google has blocked eight compromised digital certificate keys linked to eMudhra after discovering a weakness that could allow attackers to create fraudulent HTTPS certificates and impersonate websites. Mozilla has also blocked the affected certificates in Firefox, while Google plans to remove a related root certificate from Chrome's trust store on October 27, 2026.

The incident concerns the technology browsers use to establish whether a website's identity can be trusted. Although eMudhra says the affected certificates did not issue certificates to end users, Google's wider security measures could cause some legitimate websites to stop working unless their operators replace their existing certificates.

What is eMudhra and what does the company do?

eMudhra is an Indian digital trust and cybersecurity company that provides services related to digital identity, electronic signatures, authentication and public key infrastructure (PKI). Its services help businesses and individuals establish identity, sign documents electronically and secure digital communications.


One part of its business involves digital certificates issued through its certificate authority operations. These certificates help establish trust between websites, users, devices and software. Its public certificate infrastructure includes the emSign brand.

For example, when someone visits a banking website, a digital certificate helps the browser verify the website's identity and establish an encrypted HTTPS connection. Similar certificates can verify software publishers or authenticate employees and devices accessing corporate systems.

Certificate authorities act as trusted issuers of these digital credentials. Browsers and operating systems maintain lists of trusted root certificates, which form the foundation of the system. Intermediate certificate authorities operate beneath these roots and can issue certificates for websites and other entities.

This explains why the incident extends beyond eMudhra itself. If a browser stops trusting a certificate or the authority behind it, websites that depend on that certificate chain may display security warnings or become inaccessible.

How weak certificate keys created a security risk

Google's Chrome Root Program said a security researcher reported the incident on October 17, 2026. The report concerned eight eMudhra intermediate Certification Authority (CA) certificates whose private keys had been generated with insufficient randomness.

Cryptographic keys must be generated using sufficiently unpredictable data. If the randomness is weak, a key may become easier to predict or recover than intended.

In this case, someone who obtained a compromised intermediate CA private key could potentially use it to create fraudulent certificates that appeared to come from a trusted authority. Those certificates could be used to impersonate websites and undermine the trust browsers place in HTTPS connections.

Google said it corroborated the findings and blocked the affected intermediate public keys through a Certificate Revocation List Set (CRLSet) update at 19:45 UTC on October 17.

Because the update blocked the affected public-key identifiers, Chrome users received protection without having to install a new browser version or restart the browser.

What Google and Mozilla have done to protect users

Google said an equivalent update was delivered to Android devices and Googlebooks through Google Play Services at around 22:00 UTC on Monday. Most Android devices had received the update by the time of its October 20 statement. Users can also trigger an immediate update by restarting their devices.

Mozilla separately reported receiving information about the compromised certificates on October 17. It blocked them in Firefox through OneCRL, its centralised list of revoked certificates. The update reached users with standard configurations by 22:59 UTC that day, according to Mozilla.

Mozilla also released Firefox 158.0.1 for desktop and Android, along with Firefox ESR 115.43.1 and Firefox ESR 153.5.1. These releases extend protection to users whose custom settings might prevent the OneCRL update from reaching them.

The organisation is also updating its Network Security Services (NSS) certificate trust list to remove the root certificate that signed the affected intermediates. This is intended to protect applications that use Mozilla's trust store but do not receive OneCRL updates.

Google said it had checked its root stores for other keys affected by the same weak-randomness failure and found no additional keys with the same problem. It is also coordinating with browser vendors, root-store operators and software maintainers on wider remediation.

eMudhra says the affected certificates issued no end-user certificates

In its October 20 statement, eMudhra said the incident involved a specific set of intermediate certificates created during a key generation ceremony in April 2025.

The company said none of the affected intermediate certificates had been deployed in production, except one. It added that none of them, including the one deployed in production, had issued any end-entity certificates. According to eMudhra, its internal analysis and publicly available Certificate Transparency records supported this finding.

Certificate Transparency is a system that records publicly trusted TLS certificates in publicly auditable logs. It helps browsers and security researchers identify suspicious or unauthorised certificate issuance.

Google said no TLS certificates chaining to the six intermediate CAs referenced in its Certificate Transparency assessment had been logged before its blocking action. It said fraudulent certificates issued by those CAs therefore could not have been used against clients enforcing Certificate Transparency.

Chrome enforces Certificate Transparency for publicly trusted certificates by default. Certain Android applications also enforce it, depending on their target software development kit (SDK) version or configuration.

The statements refer to eight affected intermediate certificate keys overall, while Google's Certificate Transparency explanation refers to six intermediate CAs. The available statements do not fully explain the difference.

eMudhra said it had activated its incident response procedures, contained the affected certificates and begun reviewing its security controls and operational processes. Its investigation remains ongoing.

Why Google is removing an eMudhra root certificate from Chrome

Google's response goes beyond blocking the compromised intermediate keys. The Chrome Root Program has decided to remove emSign ECC Root CA - G3, the root certificate that signed the affected intermediate certificates, from the Chrome Root Store.

The move is intended to protect software and other consumers of the Chrome Root Store that do not receive CRLSet updates.

Removing a root certificate can have consequences beyond the specific compromised keys. Google warned that some legitimate certificates linked to emSign ECC Root CA - G3 would stop working in Chrome after the removal.

The change is expected to reach all devices relying on the Chrome Root Store on Tuesday morning, October 27, 2026, Pacific Daylight Time. It is expected to arrive earlier through prerelease channels, including Chrome Canary and Chrome Beta.

Google has urged website operators whose TLS certificates depend on this root to obtain and install replacement certificates issued under another public key infrastructure hierarchy included in the Chrome Root Store. eMudhra has committed to working with affected subscribers to migrate them away from the impacted root.

The company also clarified that the removal of its C1 and C3 root certificates from Mozilla's trust store was a voluntary, planned activity unrelated to this security incident.

What happens to eMudhra's remaining certificates?

Google said it is closely reviewing whether eMudhra's remaining CA certificates should continue to be included in the Chrome Root Store. Certificate authorities must continually demonstrate that they have the technical expertise and operational controls required to protect users.

Google said it would share further updates as its assessment progresses, including through public certificate authority forums.

For ordinary users, the immediate priority is to ensure browsers and devices receive the relevant security updates. Website operators using the affected root certificate chain face a more specific task: replacing their certificates before the trust-store change disrupts access.

Although eMudhra says the compromised intermediate certificates did not issue end-user certificates, Google and Mozilla have blocked the affected keys and taken additional steps to protect their wider certificate ecosystems. The outcome of Google's ongoing review will determine the implications for eMudhra's remaining public certificate infrastructure.