Certificates · disclosed 20 October 2026

eMudhra / emSign intermediate certificate keys compromised

Eight intermediate certificate authorities chaining to emSign ECC Root CA - G3 were found to have weakly generated private keys. Browsers blocked them between 17 and 20 October; Mozilla has removed the root and Chrome is expected to follow.

Detectable by a website scanYes
Last reviewed23 October 2026

What to do

Every audit checks your certificate chain. If your certificate was issued through emSign ECC Root CA - G3, replace it with one from another certificate authority.

Sources

Aikido: eMudhra CA compromise
StepSecurity: eMudhra / emSign CA compromise

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.