India’s cybersecurity agency CERT-In has warned of a security compromise involving eight intermediate digital certificate authorities linked to eMudhra, which could allow attackers to impersonate legitimate websites, intercept communications or make malicious software appear to be signed by trusted publishers.
In an advisory issued on October 21, CERT-In said the private keys associated with six TLS certificate authorities and two code-signing certificate authorities had been compromised because they were generated using insufficient cryptographic randomness. The affected elliptic-curve private keys had exceptionally small values and could be recovered almost instantly.
However, eMudhra has said that none of the affected intermediate certificate authorities had issued certificates to end users or individual websites. The company has also clarified that its root certificate authority’s private keys and other intermediate certificate authorities were not affected.
TLS certificates help browsers verify website identities and establish encrypted connections to protect information exchanged between users and online services. If attackers use compromised private keys to issue fraudulent certificates, they could impersonate legitimate websites and potentially steal login credentials, access sensitive information or commit financial fraud.
Mozilla has blocked the six affected TLS intermediate certificates through its OneCRL certificate block list. It has released Firefox 158.0.1 for desktop and Android, Firefox ESR 115.43.1 and Firefox ESR 153.5.1 to protect users whose configurations prevent them from receiving OneCRL updates. Mozilla has also updated its Network Security Services (NSS) 3.131.1 trusted certificate list to remove the root certificate that signed the affected intermediates.
Google has blocked the public keys of the affected TLS intermediates in Chrome through a Certificate Revocation List Set update. It has also announced that the emSign ECC Root CA - G3 certificate will be removed from the Chrome Root Store, with the change scheduled for October 27, 2026. The move is intended to protect applications and devices that do not receive or enforce information about revoked intermediate certificates.
The removal of the root certificate from browser and application trust stores could also cause legitimate certificates issued under it to become untrusted, potentially disrupting affected websites and services.
Google reported that no TLS certificates linked to the six affected intermediate authorities had been recorded in Certificate Transparency logs before its blocking action. These logs are public records of website certificate issuance and help security researchers and browser companies monitor potentially suspicious certificates.
CERT-In has advised government departments, enterprises, internet service providers, software vendors and website administrators to install the latest security updates for affected browsers, applications and operating systems. They should also ensure that their systems receive the latest certificate revocation and distrust information from software vendors.
Organisations have been asked to identify websites, applications and services that rely on the affected intermediate authorities or the emSign ECC Root CA - G3 certificate. Where required, administrators should replace affected TLS certificates with certificates issued under a trusted and unaffected certificate authority.
For ordinary users, updating browsers and operating systems is an important first step. Organisations managing websites, servers and enterprise applications should assess their dependence on the affected certificates and take corrective action to avoid security risks and service disruptions.