In October 2026 eight intermediate certificates from eMudhra were found to have private keys so weak that anyone could recover them. eMudhra revoked them on October 18, and Mozilla and Google moved to distrust its emSign ECC Root CA - G3. Website owners should check who issued their SSL certificate and replace any that chain to that root.
Most small business websites use certificates from other authorities and will not notice anything. But this is one of the more serious certificate authority incidents in years, and it is a useful reminder to know where your certificates come from.
Key takeaways
- Mozilla was told on October 17, 2026 that eight eMudhra intermediate CA private keys were trivially recoverable, and eMudhra revoked all eight on October 18.
- Mozilla removed trust in the emSign ECC Root CA - G3, and Mozilla's bug tracker says Chrome's matching root store update was expected on October 27.
- eMudhra says no certificates were issued from the weak intermediates, but certificates chaining to the distrusted G3 root need replacing.
- Most small business websites are not affected, but a two-minute issuer check and up-to-date software are worth doing now.
What happened
According to Mozilla's incident bug 2083449, a researcher reported on October 17, 2026 that the private keys of eight eMudhra intermediate certificate authorities could be recovered. Six were for TLS (website) certificates and two for code signing. Mozilla independently recovered the keys the same evening.
The timeline from the Mozilla bug and eMudhra's own statement:
| Date (2026) | Event |
|---|---|
| October 17 | Report received by Mozilla; Firefox blocks the intermediates through its OneCRL revocation list the same day |
| October 18 | eMudhra revokes all eight intermediates as compromised |
| October 19 | Sectigo completes revocation of its cross-signed copies of the affected certificates |
| October 20 | Mozilla announces emergency removal of trust in emSign ECC Root CA - G3; eMudhra publishes its first statement |
| October 22 | eMudhra updates its statement and offers Sectigo-issued certificates to customers |
| October 27 (expected) | Chrome root store update, according to the Mozilla bug |
eMudhra says the intermediates were created in a key ceremony on April 30, 2025, and that a flaw in one step "produced a second, weak set of keys alongside the original strong keys", and the weak ones were the ones published. It states that "No certificates had been issued from any of them, our infrastructure was not compromised, and no data was breached." The Mozilla bug notes that the root cause is still being investigated and that browser root programs have sent eMudhra detailed questions.
Why a weak intermediate key is dangerous
A certificate authority vouches for websites. If an attacker holds a trusted intermediate key, they can create a certificate for any domain that a browser would accept. In Cloudflare's write-up of October 20, 2026, the company explains: "Because the keys themselves are weak, an attacker can create a forged certificate for any domain". Cloudflare says its review found no active exploitation on its services.
That is why browsers acted within hours, and why software that does not check revocation, such as some apps, containers and older devices, needed updates too.
Who is affected
- Sites with certificates chaining to emSign ECC Root CA - G3. eMudhra says the impact on TLS certificates is "contained to a single customer ecosystem in the United States". The Mozilla bug records an analysis of roughly 30,800 unexpired precertificates chaining to that root, mostly from InCommon subordinate CAs.
- Organizations running their own software and servers, such as APIs, containers and internal tools, which rely on operating system or language trust stores that needed patching.
- Cloudflare customers using its client apps, Tunnel or strict origin validation with custom certificates. Cloudflare lists required versions and steps in its post.
eMudhra states that its digital signature and eSign services are separate and continue to operate normally. Most small businesses in the US, UK, EU, Canada and Australia use free or low-cost certificates from other authorities through their host, and are not directly affected.
Practical checklist
- Check your certificate issuer. Run your domain through our free SSL checker and look at the issuer and chain. If you see eMudhra, emSign or an InCommon certificate chaining to emSign ECC Root CA - G3, contact your provider for a replacement now.
- Check every hostname, not just the homepage. Subdomains for shops, booking systems or email login pages may use different certificates. Our guide on how to check an SSL certificate shows what to look for.
- Update browsers and software. Firefox, Chrome and operating systems receive trust updates automatically, but servers, containers and apps may not. Patch and redeploy anything that makes outgoing HTTPS connections.
- Never "fix" errors by turning off verification. Cloudflare warns: "It's important to not resolve these errors by disabling verification." Replace the certificate or update the trust store instead.
- Restrict who can issue for your domain. A CAA DNS record tells certificate authorities which of them may issue certificates for your domain. See our guide to CAA records and check your current records with our DNS lookup.
- Confirm modern TLS. While you are there, run our TLS version checker to make sure old protocol versions are off.
- Automate renewals and monitoring. Shorter certificate lifetimes are coming anyway, as our post on 200-day certificates explains. Automated checks, which Make It Flow can help set up, catch problems before customers do.
If visitors report certificate warnings, our article on SSL certificate errors explains the common causes.
FAQ
What is the eMudhra certificate compromise?
In October 2026 the private keys of eight eMudhra intermediate certificate authorities were found to be trivially weak. Anyone could have used them to create trusted certificates for any domain. eMudhra revoked them on October 18, and Mozilla and Google moved to distrust the related emSign ECC Root CA - G3.
Is my website affected by the eMudhra incident?
Only if your SSL certificate chains to the emSign ECC Root CA - G3. eMudhra says the TLS impact is contained to a single customer ecosystem in the United States. Check your certificate's issuer and chain with an SSL checker, and ask your provider for a replacement if eMudhra appears.
Were any fake certificates used in attacks?
Cloudflare said its security review found no active exploitation on its services, and eMudhra says no certificates were issued from the weak intermediates before the report. Because the keys became public, browsers and software vendors blocked them quickly to stop any future misuse.
Do I need to do anything if I use Let's Encrypt or my host's free SSL?
Not for this incident, unless your certificate chain includes eMudhra or emSign. It is still sensible to keep server software and operating systems updated, check your certificate chain occasionally and add a CAA record listing the certificate authorities you actually use.
What does a CAA record do?
A CAA record is a DNS entry that lists which certificate authorities may issue certificates for your domain. Authorities must check it before issuing. It does not stop a compromised authority from misbehaving, but it reduces the chance of an unwanted certificate being issued through normal channels.
Related reading
- TLS 1.0 and 1.1: How to Check Your Server and Disable Them: Check which TLS versions your server accepts, find out who still uses old ones, then disable TLS 1.0 and 1.1 on Apache, Nginx, IIS, cPanel and Cloudflare.
Sources
More guides for your industry
Free checklist (PDF)
Free web developers website checklist
31 practical checks for web developers: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
