Compromised eMudhra CAs

October 17, 2026

A researcher found that the private keys of 8 eMudhra intermediate CAs could be recovered from their public certificates (the keys were generated with too little randomness). With them, anyone could issue certificates for any website that browsers would trust.

October 17–19

Chrome and Firefox blocked the 8 CAs. eMudhra revoked them on October 18, and Sectigo revoked its cross-signed copies on October 19.

October 20

Google announced that Chrome removes emSign ECC Root CA - G3, the root above them. Mozilla and Debian removed it too.

October 27, 2026

Chrome stops trusting emSign ECC Root CA - G3. Sites whose certificate chains to it stop working in Chrome, even if their own certificate was never at risk.

Who is affected

• Sites with a certificate from eMudhra (emSign) that chains to emSign ECC Root CA - G3.
• Apps and servers that use an old copy of the trusted certificates still accept the compromised CAs until they are updated: operating system CA certificates, and those bundled with Python (certifi), Go and Node.js.

If the check finds one

• Install a certificate from another certificate authority before October 27, 2026.
• Then check again here: the result should show neither the compromised CAs nor the root.

Sources: Google's announcement, CCADB (the revoked CA certificates).

Every certificate the server sends, matched by its public key, so each copy of a CA counts (eMudhra's own and the one cross-signed by Sectigo's AAA Certificate Services).

Compromised CAs

Keys compromised October 17, 2026; revoked by eMudhra and blocked by Chrome and Firefox.

• EM DV TLS CA - G3B
• EM DV TLS CA - G3C
• EM OV TLS CA - G3B
• EM OV TLS CA - G3C
• EM EV TLS CA - G3B
• EM EV TLS CA - G3C
• EM OV CS CA - G3B
• EM OV CS CA - G3C

Distrusted root

Removed from the Chrome Root Store from October 27, 2026; also removed by Mozilla (NSS) and Debian.

• emSign ECC Root CA - G3