A Warning From India’s Cyber Agency
On 21 October 2026, the Indian Computer Emergency Response Team (CERT-In) published advisory CIAD-2026-0050 about eight compromised digital keys belonging to eMudhra, an Indian certificate authority. A certificate authority is a company that browsers trust to vouch that a website is genuine. The advisory came four days after a researcher alerted browser makers. Mozilla received that report at 20:06 UTC on 17 October. Its block reached Firefox users by 22:59 UTC that night, and CERT-In says Google blocked the keys in Chrome the same day.
Keys Small Enough to Guess
A secure key should be a huge random number. According to Mozilla’s Dennis Jackson, all eight keys were whole numbers below 256, so anyone could recover them almost instantly. Holders of such keys could create fake website certificates that browsers would accept. Jackson wrote that “the impact of this incident could not be higher.” He also said artificial intelligence agents he tested recovered the keys on the first try. No source says attackers used such tools.
Google reported that no website certificate from the six relevant authorities had appeared in Certificate Transparency, a public log of issued certificates, before it blocked them, CERT-In says. Browsers that demand a log entry could therefore not have been fooled. CERT-In adds that, as of 21 October, public disclosures do not confirm any malicious use of the keys.
Browsers Remove the Root Itself
Mozilla then removed the parent root, called emSign ECC Root CA - G3, from its trusted list, saying some software cannot receive revocation notices. Google plans the same for Chrome on 27 October, according to CERT-In. Legitimate certificates under that root will stop working. The Chrome Root Program team counted about 30,800 unexpired certificates chaining to it in Certificate Transparency data on 21 October 2026, and 99.9 percent came from two InCommon intermediate authorities.
What eMudhra Says
eMudhra says a flaw in a key-generation step on 30 April 2025 created a second, weaker set of keys, and those weak keys were the ones published to browsers. It says none of the eight authorities issued a certificate to any customer, and that its Indian digital signature certificate and eSign services run on separate systems. The company estimates about 30,000 certificates need replacing, and says affected customers are in the United States.
Our Analysis
Older cases show how this one differs. In 2013, Mozilla revoked two mis-issued TURKTRUST certificates after evidence that one was used to intercept traffic for domains its holder did not own. The harm was real and the fix narrow. Here, misuse is unconfirmed, yet browsers removed a whole root, because several people recovered the keys independently and some software ignores revocation.
Three gaps remain. eMudhra says the flaw survived two independent audits across about 18 months, so a researcher caught what auditors did not. CERT-In’s reassurance about Indian signature services rests on reports and eMudhra’s statements, and the advisory does not say the agency tested it. eMudhra’s own page dates the report 18 October and revocation 19 October, while Mozilla’s log shows revocation on 18 October. Chrome’s team also asked why eMudhra re-signed faulty revocation lists in 2025 instead of investigating.