A certificate-security incident involving India’s eMudhra came to light in October 2026 after eight intermediate Certificate Authority (CA) private keys were found to be recoverable.
Mozilla received a report on 17 October 2026 and independently recovered the affected keys, confirming the weakness. The incident involved cryptographic key generation rather than a conventional leak of customer records or passwords.
What happened?
The eight affected certificates belonged to eMudhra’s certificate infrastructure. Six were intended for TLS certificate issuance and two were associated with code signing.
According to Mozilla’s investigation, the certificates used the P-384 elliptic-curve cryptographic system, but their private key values were exceptionally small, making them recoverable through a limited search.
The problem was a key-generation failure, not a break in the P-384 algorithm itself.
How did it happen?
According to eMudhra’s incident statement, the affected keys originated from a key-generation ceremony conducted on 30 April 2025. The company said it was investigating a script involved in the process.
Although eMudhra reported using hardware security modules (HSMs), the weak keys demonstrate that the generation process failed to produce the expected cryptographic security.
Incident timeline
- 30 April 2025: The affected keys were generated during a key-generation ceremony, according to eMudhra.
- 17 October 2026: Mozilla received the report and independently recovered the affected private keys.
- 18 October 2026: eMudhra reported revoking all eight affected intermediate certificates.
- 19–20 October 2026: Mozilla and other technology providers announced additional mitigation measures.
Mozilla also reported that its initial OneCRL blocklist update reached Firefox users with standard configurations by 22:59 UTC on 17 October.
What does this mean for readers?
The incident does not, by itself, mean that personal data or passwords were leaked. The confirmed issue concerns the security of certificate-signing keys. Browser and software providers have introduced measures to block the affected certificates. Users should keep their browsers and operating systems updated.
What did eMudhra confirm?
In its statement updated on 20 October 2026, eMudhra reported that:
- All eight affected intermediate certificates had been revoked.
- Its root CA private keys and other intermediate CAs were unaffected.
- The affected intermediates had not issued end-entity certificates, except for one deployed in production.
- That deployed certificate had not issued end-entity certificates.
- Its investigation into the key-generation process was continuing.
Conclusion
The eMudhra incident exposed a serious weakness in the generation of eight intermediate CA private keys. Mozilla independently recovered the keys, and eMudhra revoked the affected certificates.
As of 21 October 2026, the investigation into the underlying key-generation failure remained ongoing.
