---
title: 'eMudhra emSign intermediate CA keys were recoverable by anyone; browsers block them and remove the root'
url: 'https://securteksecurity.com/news/emudhra-emsign-intermediate-ca-keys-compromised-browsers-block-root-removal'
markdown: 'https://securteksecurity.com/news/emudhra-emsign-intermediate-ca-keys-compromised-browsers-block-root-removal.md'
date: '2026-10-20'
description: 'On October 17, 2026, a researcher reported to the Chrome Root Program that the private keys of eight eMudhra subordinate certificate authority certificates had been generated with insufficient randomness, enabling anyone to forge trusted HTTPS certificates. Google says the P-384 keys were recoverab…'
taxonomy:
  category:
    - Cybersecurity
---

# [eMudhra emSign intermediate CA keys were recoverable by anyone; browsers block them and remove the root](https://securteksecurity.com/news/emudhra-emsign-intermediate-ca-keys-compromised-browsers-block-root-removal)

   20th Oct 2026  

On October 17, 2026, a researcher reported to the Chrome Root Program that the private keys of eight eMudhra subordinate certificate authority certificates had been generated with insufficient randomness, enabling anyone to forge trusted HTTPS certificates. Google says the P-384 keys were recoverable because they were generated with weak entropy; Mozilla's incident reporting says the keys were all integers below 256 and that multiple individuals independently recovered them, with researcher Scott Helme recovering all eight on a laptop in under a second. The keys date to an April 30, 2025 ceremony, so they were effectively recoverable for about 17 months. Chrome blocked the six TLS intermediates by CRLSet on October 17 at 19:45 UTC and Firefox blocked all eight via OneCRL the same evening; Apple devices blocked from October 19 and Microsoft platforms from October 20, according to the Mozilla maintained incident site. eMudhra has revoked all eight intermediates.

Chrome will remove the emSign ECC Root CA - G3 from the Chrome Root Store on October 27, 2026, and Mozilla has shipped trust store removals through NSS; Go, Python certifi, Rust webpki roots and Debian have also shipped removals. No TLS certificates chaining to the six TLS intermediates were logged to Certificate Transparency before the block, and no exploitation has been reported by any source checked. The residual risk is non browser clients with bundled trust stores that do not enforce Certificate Transparency or revocation. This item names the certificate authority behind the Go emergency update held on October 20, when the CA was not yet named.

Sources: [Google Chrome Root Program](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/); [Rescana](https://www.rescana.com/post/emudhra-intermediate-ca-key-compromise-october-2026)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Elvis Presley rightsholders sue Anthropic over 274 songs](https://securteksecurity.com/news/elvis-presley-rightsholders-sue-anthropic-274-songs.md)
- Next: [Energize Lab Eilik and Eiliko robots expose millions of private chats and can be remotely hijacked](https://securteksecurity.com/news/energize-lab-eilik-eiliko-robots-expose-chats-fleet-hijackable.md)