How eMudhra’s Eight Compromised CA Keys Reached an Exchange Filing in Four Days

On 17 October 2026, a security researcher reported to the browser root programs that the private keys behind eight intermediate certificate authority certificates had been compromised. The certificates belong to eMudhra, an Indian certificate authority. In the four days that followed, the browser makers blocked the certificates and published notices, and eMudhra made its own statements.

For a company that issues certificates, or sells products built on them, the order of those messages matters. The browsers acted within hours, and eMudhra’s own statement came three days after the first report. The sequence shows how a disclosure unfolds when several parties must speak about the same failure.

Four Days From Researcher Report to Exchange Filing

Chrome received the report at 18:05 UTC on 17 October. At 19:45 UTC the same day it shipped a block for the six TLS intermediates. Google’s post says the block works by key, so it covers every certificate sharing those keys, and the Chrome Root Program thread names the Sectigo cross-signed copies among them. Mozilla received its report at 20:06 UTC and finished a block for standard Firefox settings by 22:59 UTC, which its post describes as less than three hours after the report.

Other platforms followed. The Hacker News reports that Apple blocked the certificates on 19 October and Microsoft on 20 October. Google says Android devices and Googlebooks received an equivalent update through Google Play Services at about 22:00 UTC on 19 October.

On 20 October, Chrome and Mozilla published public notices, and eMudhra posted a statement on its website. On 21 October, eMudhra filed a press release with the BSE, the Indian stock exchange, according to The Hacker News.

The First Block Came Quickly
According to Google’s post, Chrome’s block by key of the affected intermediates was in place at 19:45 UTC on 17 October, one hour and 40 minutes after the researcher’s report at 18:05 UTC.

How the Browser Makers Put Protection Ahead of Cause

Chrome’s post on 20 October set out what the block covers. It said no TLS certificates chaining to the six intermediates had been logged to Certificate Transparency before the block, so no fraudulent certificate issued from them could have been used against browsers that enforce logging. It also said Chrome had checked every other certificate authority in its store and found no other instances of the failure.

Chrome said it is still reviewing eMudhra’s remaining CA certificates. Chrome’s review of eMudhra’s remaining CA certificates therefore remains open.

Mozilla’s post took a narrower approach. It explained that most Firefox users are protected by OneCRL, a block list that takes effect without an update or restart. Users whose custom settings may have prevented that update receive the protection through Firefox 158.0.1 and the ESR releases. The post did not describe the cause or how Mozilla had dealt with eMudhra, and it said more information would follow as soon as circumstances allow.

Taken together, the two posts put protection for users first, and Mozilla left the cause for later.

What eMudhra Said on 20 and 21 October

According to The Hacker News, eMudhra’s 20 October statement said its root CA private keys and other intermediates were not affected. It said only one of the eight certificates had been deployed in production and that none had issued end-entity certificates.

The 21 October filing, as The Hacker News describes it, blamed a flaw in the April 2025 key ceremony. That flaw produced a weak set of keys alongside the strong ones. The filing said its infrastructure had not been compromised and no data was breached. It put the global TLS business at about 1% of revenue, acknowledged a reputational risk it could not quantify, and said it is issuing replacement certificates.

The two documents answer different questions. The statement covered which certificates were in use, and the filing covered what caused the failure and what customers receive next.

The browsers acted within hours, and eMudhra’s own statement came three days after the first report.

What Customers Were Told to Do Before the Chrome Removal

Google’s post sets out the instruction for customers. Website operators with certificates that chain to emSign ECC Root CA – G3 must obtain and install a new TLS certificate from another hierarchy in the Chrome Root Store, or their sites may break. The post says some legitimate certificates chaining to that root will stop working in Chrome after removal, which Google expects to reach all devices on the morning of 27 October, Pacific time.

The Chrome Root Program thread describes the removal as Chrome Root Store version 43. It also says Chrome users are already protected by the block, and the removal is meant to help downstream software that uses the Chrome Root Store without the block list. Google says eMudhra has committed to helping affected subscribers migrate.

Mozilla’s post does not name the root it is removing. It says NSS 3.131.1 removes the root that signed the affected intermediates. The Hacker News says Mozilla removed emSign ECC Root CA – G3 on 20 October.

What a Women-Led Company Should Have Ready Before Its Own Incident

The points below are editorial, drawn from this sequence. They are not requirements stated in these sources.

Who speaks: each channel in this case had its own voice. The browsers posted technical notices, and eMudhra used its website and then an exchange filing. A founder-led company needs a named spokesperson for each channel, and one person who keeps a timeline in UTC, the unit these sources use.

What customers are told: customers here were given a concrete action, which was to obtain a replacement certificate before a set date. A company that depends on certificates needs an inventory of which provider issued each one, when it expires, and which customers and systems rely on it.

Scope and cause: the statements kept those apart. eMudhra’s website said only one of the eight certificates was in production, and its filing separated its infrastructure from the ceremony flaw. Mozilla shared protection while holding back the cause. A founder’s statement can likewise say what is confirmed and what is still under review.

Partners and regulators: eMudhra’s filing reached the market through an exchange. A private company has no such channel, so it needs a written list of who hears first, such as hosting providers, certificate vendors, payment and marketplace partners, and its own customers, decided before an incident rather than during one.