eMudhra certificate compromise

eMudhra is a certificate authority based in India. In October 2026 keys used by its certificate authority proved guessable. Firefox blocked eight compromised eMudhra certificates, and eMudhra stopped issuing TLS certificates. This page follows the story as browsers, programming languages and other software respond.

3 reports, last updated 2026-10-27

Latest

2026-10-27, Analysis eMudhra CA key leak: browsers are blocked, bundled trust lists may not be Endor Labs says two popular HTTP libraries carry old root lists that no operating system patch will change

Earlier reporting

2026-10-22, Analysis eMudhra stops issuing TLS certificates days after its CA keys proved guessable Chrome and Firefox blocked the keys within hours; Apple and Microsoft took until Monday and Tuesday. 2026-10-20, Analysis Firefox blocked eight compromised eMudhra certificates in under three hours The fast fix reached most Firefox users. Software that copies Mozilla's trust list is the open question.

Other trackers: PHP2Shell, Windows updates, Node.js security releases, DeepSeek