Donate Now

tl;dr

On 17 October 2026, a security researcher told the browser makers that the private keys of eight intermediate certificate authorities run by eMudhra Limited could be worked out by anyone from the certificates themselves. eMudhra is a Bengaluru company licensed by the Controller of Certifying Authorities (CCA) to issue digital signature certificates in India. One of the keys was the number 4. The keys were created in April 2025. eMudhra says only one of the eight was ever put into use and that none issued certificates, but anyone who worked out a key could have issued certificates of their own. Google, Mozilla, Apple and Microsoft blocked the certificates within three days, and eMudhra revoked them on 18 October. Software outside the browser, much of which does not check whether a certificate has been revoked, stays exposed until it is updated. eMudhra explained the cause on Mozilla’s public bug tracker.…