eMudhra Statement on Recent Certificate Security Incident

Updates are listed in sequential order.

1. Update 1

   20 October 2026 Link to this update

   On 20 October 2026, Mozilla published a post on its Security Blog regarding eMudhra intermediate certificates. According to Mozilla:

   • On 17 October 2026 at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised.
   • Mozilla blocked the affected certificates in Firefox through OneCRL, its centralised list of revoked certificates. By 22:59 UTC the same day, the update had reached all Firefox users with standard configurations, without requiring them to update or restart Firefox.
   • Mozilla released Firefox 158.0.1 (Desktop and Android), Firefox ESR 115.43.1 and Firefox ESR 153.5.1 to extend this protection to users whose custom settings may have prevented the OneCRL update.
   • Mozilla is updating the trusted certificate list in NSS (NSS 3.131.1) to remove the root certificate that signed the affected intermediates, to protect other applications that use Mozilla’s trust store but do not receive OneCRL updates.

2. Update 2

   20 October 2026 Latest Link to this update

   eMudhra is actively investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) conducted in April 2025 within its public trust infrastructure.

   The incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs.

   Importantly, none of the affected intermediate CAs were deployed in production, with the exception of one. Furthermore, none of these intermediate CAs, including the one deployed in production, have issued any end-entity certificates. This has been confirmed through our internal analysis and corroborated by publicly available Certificate Transparency records on crt.sh.

   Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem.

   We are conducting a thorough investigation into the circumstances surrounding the incident and reviewing our security controls and operational procedures to identify and implement any necessary improvements.

   The security and integrity of our trust services remain our highest priority. We are committed to transparency, adherence to industry standards, and continued collaboration with the global WebPKI community.

   To avoid any misunderstanding, the removal of our Root CA’s C1 and C3 with Mozilla was a voluntary and planned activity and does not pertain to this security incident.

   We will provide further updates as our investigation progresses and additional findings are confirmed.