The story most readers took from eMudhra's October is a story about a bad bug. Eight of the Indian company's intermediate certificate authorities, the servers that vouch for websites so that a browser shows a padlock, had private keys so weak that they had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers, BleepingComputer reports. A key like that is not a lock. Palo Alto Networks' Unit 42 says the weakness let third parties sign unauthorized public TLS certificates, the raw material for intercepting traffic to a targeted site.
That is the surface read, and it is accurate. It is also not why eMudhra is leaving the business. Bugs happen at certificate authorities. What browser root programs punish is what a company says next, and whether it turns out to be true.
The browsers moved the same day
Mozilla says it received the report on Saturday, October 17, at 20:06 UTC, and it pushed a block through its OneCRL revocation list without requiring users to update or restart Firefox. Google's Chrome Root Program got the same report about two hours earlier and, Google says, landed a CRLSet update blocking the Subject Public Key Info (SPKI) hashes of the affected intermediate CAs.
The good news was real. Google says no TLS certificates chaining to these six intermediate CAs were logged to Certificate Transparency before the block, which means there is no public trace of a forged certificate. The browsers then went further than the eight keys. Chrome removed emSign ECC Root CA - G3, the root that signed the compromised CA certificates, and Mozilla said it is updating its NSS library to remove the root certificate that signed the affected intermediates.
What eMudhra said next
On Mozilla's incident bug, eMudhra's first answers were about scope. eMudhra wrote that "we verified that similar other Issuers are not affected by the same issue". A day later it was more specific: "The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted."
That sentence is the hinge of the whole episode. On 7 November, eMudhra's own incident report records eight RSA G2B/G2C subordinate CA certificates revoked (reason: cessationOfOperation) and withdrawn from service. Those are RSA issuers, the group it had called not impacted almost three weeks earlier. BleepingComputer counts the revoked total at 16, including certificates used to issue TLS and code-signing certificates.
The second eight were withdrawn with the reason logged as cessation of operation, not as a weak key. eMudhra's report traces the first failure to an import step in which a bug/defect in the import code resulted in a read-back from the unwrapped object that truncated the private value. In the meantime the issuers kept working. A reviewer on Mozilla's thread notes that EM OV TLS CA - G2C continued issuing end-entity certificates until 3 Nov 2026, 13:48:16 UTC, 17 days after the report.
An earlier warning in the same report
The detail that will weigh most with root programs sits in a table of related incidents. eMudhra lists a case in which CRLs for the six G3B/G3C TLS intermediates were signed with a key that did not match the public key, an event dated to June 2025. A revocation list signed with the wrong key is a sign that the keys in use are not the keys that were certified. The keys at the centre of October's failure were P-384 keys generated in April 2025, BleepingComputer reports. In other words, the system produced a related symptom months before an outside researcher found the fault itself.
This is the pattern root programs are built to catch. A certificate authority is trusted by the major browsers on the strength of its own word about its own keys. When that word has to be revised, the browsers have no way to check the next one except to wait for an audit, and the independent review has now been deferred to 4 December 2026, a reviewer on the thread notes.
The exit, and who decided it
Google set its own deadline. Its 4 November update says TLS certificates chaining to emSign Root CA - G1 whose earliest Certificate Transparency timestamp falls after 16 November 2026 will no longer be trusted by default in Chrome 153 and higher. eMudhra's incident report, for its part, says eMudhra has additionally decided to exit the public TLS business and that all issuance from the G1 hierarchy will stop prior to 16 November 2026. The two dates match.
The cost to customers is smaller than the headlines suggest. eMudhra estimated about 30,000 certificates that require migration, about 97 percent of them issued via ACME, the automated protocol many web servers use to renew certificates. That leaves roughly 900 certificates on manual routes.
Why India should read this closely
The business being lost is small. eMudhra says global SSL/TLS is a small part of eMudhra's business contributing to about 1% of the global revenue. Its larger franchise is the digital signature certificate used for Indian tax, company and tender filings. eMudhra is one of the certifying authorities licensed by India's Controller of Certifying Authorities, whose list of 23 licensees runs Safescrypt, IDRBT, (n)Code Solutions, e-Mudhra, CDAC, Capricorn and onward. eMudhra says the incident has no connection with eMudhra's Indian Digital Signature Certificate (DSC) and eSign businesses, which run on separate infrastructure.
| Trust regime | Who grants trust | What eMudhra sells under it | Status after the incident |
|---|---|---|---|
| Web TLS certificates | Browser root programs such as Google's and Mozilla's | Padlock certificates for websites | Exit announced; Chrome G1 cutoff 16 November 2026 |
| Indian digital signatures | Controller of Certifying Authorities, under the IT Act | DSC and eSign for filings | eMudhra says unaffected |
Source: Google; eMudhra filings on Mozilla Bugzilla; eMudhra; Controller of Certifying Authorities.
The two regimes judge the same company by different methods. The browser programs run their oversight in public, on a bug tracker anyone can read, and they enforce in hours through revocation lists. That transparency is what turned a company statement into a dated, checkable claim, and then into a reversal anyone could see.
The honest objection
The strongest case for eMudhra is that it did several things right. It revoked the first eight issuers quickly, and Google says no TLS certificates chaining to these six intermediate CAs were logged to Certificate Transparency before the block. It also revoked the RSA issuers on its own assessment rather than waiting to be forced. On this view, revoking more than strictly necessary is the cautious choice, and punishing it teaches certificate authorities to say less.
That argument is fair, and it is why the first batch alone would probably not have ended the business. What the root programs were judging was accuracy. A certificate authority that says other issuers are safe, then withdraws them, and also lists a June 2025 case of CRLs signed with a key that did not match the public key as a related incident, has given the browsers two statements they cannot both rely on. Caution after the fact does not repair that.
The Signal
The instinct in India is to read this as a story about one company's code. It is better read as a story about where trust is decided. The padlock on an Indian website is granted in Mountain View and by Mozilla, on public evidence, in hours. The signature on an Indian tax filing is governed by a licensing regime at home. eMudhra kept its signature franchise and lost the padlock, and the deciding moment was not the weak key. It was the sentence that said the other keys were fine.
Reporting basis: the timeline of the browser response rests on two independent origins, Mozilla's security blog and Google's Chrome Root Program post, each describing its own action. eMudhra's statements on scope, its 7 November revocation, its account of what went wrong, the June 2025 related incident, the migration figure and its exit are from the company's own filings on Mozilla's public incident bug 2083449; the 3 November issuance date and the 4 December review date are a reviewer's summary on that same thread, so they share that origin. The key-strength detail and the total of 16 revoked issuers are per BleepingComputer, and the interception risk is per Palo Alto Networks' Unit 42. The revenue share and the statement that Indian DSC and eSign are unaffected are eMudhra's own press releases, and the list of licensed certifying authorities is from India's Controller of Certifying Authorities. The day counts, the 29,100 and 900 split of migrated certificates, and the comparison table are The Signal's calculations and compilation from those figures.
