eMudhra to Exit Global SSL/TLS Business After Eight Intermediate CA Keys Found Guessable

Summary

eMudhra will exit its global SSL/TLS business after a researcher recovered eight guessable intermediate CA keys. Chrome and Firefox distrusted affected certificates, prompting a transition for tens of thousands of certificates.

Key points

• A researcher reported recovering eight eMudhra intermediate CA private keys on October 17; the keys were small enough to be worked out almost instantly.
• Chrome and Firefox blocked six TLS intermediates. Chrome plans to stop trusting the emSign ECC Root CA - G3 on October 27.
• Chrome counted about 30,800 unexpired certificates chained to that root as of October 21; eMudhra estimated about 30,000 certificates need to be moved.
• eMudhra said it will replace affected customers' certificates with free certificates from partners, but did not name the partners or give an exit date.
• Google told affected website operators to obtain and install a certificate from another PKI hierarchy trusted by Chrome. Many affected certificates use ACME, but standard clients may not replace them outside their renewal window.
• eMudhra said it did not use the eight keys to issue certificates and that its systems were not breached. It will continue revocation and status services until issued certificates expire or are replaced.
• Chrome raised concerns about eMudhra's handling and transparency, including invalid certificate revocation lists in 2025 and a separate recent CRL whose signature reportedly appeared to use an OCSP certificate key.

Vendors

Products

Industries