Home / Technology / Digital Trust Compromised: Keys Blocked!
Digital Trust Compromised: Keys Blocked!
21 Oct
Summary
- Google and Mozilla blocked compromised keys from eMudhra.
- Weak key generation could allow forging of HTTPS certificates.
- A root certificate removal may disrupt some websites.
Google and Mozilla have taken action against eight compromised digital certificate keys associated with eMudhra, an Indian digital trust and cybersecurity services provider. The vulnerability stemmed from weak randomness during key generation, which could enable attackers to forge trusted HTTPS certificates and impersonate websites. Google blocked the keys on October 17, 2026, through a Certificate Revocation List Set update, providing immediate protection to Chrome users.
Mozilla also blocked the affected certificates in Firefox on the same day. Furthermore, Google intends to remove a specific root certificate, 'emSign ECC Root CA - G3,' from Chrome's trust store on October 27, 2026. This action aims to safeguard users but may cause some websites relying on this root to cease functioning unless their operators obtain replacement certificates.
eMudhra has stated that the affected intermediate certificates, generated in April 2025, did not issue any end-entity certificates. However, Google's broader security measures, including the root certificate removal, necessitate action from website operators. The company is reviewing eMudhra's remaining certificates for continued inclusion in Chrome's trust store.
