NexusSec.eMudhra is one of India's best-known certificate authorities, so the news worried many businesses that use its digital signature certificates. The facts are more contained than the headlines suggested. This post reflects what was published up to 1 November 2026.
What happened
On 17 October 2026, a researcher reported to the browser root programs that the private keys of eight eMudhra intermediate certificate authorities, six for website TLS certificates and two for code signing, could be calculated from their public certificates. The keys had been generated with too little randomness, so recovering them needed no break-in. eMudhra traced the problem to a key ceremony on 30 April 2025.
The response was quick. Chrome and Firefox blocked the certificates on 17 October, Apple and Android on 19 October and Microsoft on 20 October, and eMudhra revoked all eight. Mozilla also removed eMudhra's emSign ECC Root CA – G3 from its trust store, and Chrome announced it would do the same.
Was anything misused?
eMudhra says only one of the eight intermediates was in production and none of them issued any end-entity certificate. Chrome found no TLS certificates chaining to the six TLS intermediates in Certificate Transparency logs before its block. CERT-In's advisory CIAD-2026-0050 of 21 October said the public disclosures did not establish confirmed malicious use. Misuse cannot be completely ruled out, because certificates that were never logged are hard to see.
What it means for Indian businesses
eMudhra told the stock exchange that its infrastructure was not compromised and no data was breached, and said the incident has no connection to its Indian digital signature certificate (DSC) and eSign businesses. Nothing in the disclosures so far suggests that businesses using eMudhra DSCs for filings need to replace them.
The real exposure is software that does not use the browser's or operating system's certificate store but keeps its own list. It may still trust the compromised intermediates until it is updated.
What to do
- Keep browsers and operating systems updated. They already block the certificates.
- Update software that carries its own certificate list. Reported fixes include Go 1.27.3 and 1.26.10 (rebuild your Go programs), NSS 3.131.1, current Firefox and Firefox ESR, and updated Ubuntu and Debian packages. Python's certifi and Rust's webpki-roots were updated or pending, and Node.js and Red Hat fixes were still pending at the time of the reports.
- Check appliances, VPN clients and in-house applications that validate TLS certificates, and ask vendors whether they have updated their certificate bundles. WordPress, for example, updated its bundled root certificates in WordPress 7.1.4.
- If you bought a TLS certificate from eMudhra, check which chain it uses; the company says it is issuing replacements to affected customers.
- Watch for side effects. Some fixes remove whole roots, which can also break legitimate certificates that chain to them.
If your firewall decrypts traffic, its trusted certificate list matters too; see TLS inspection: what to decrypt.
