eMudhra exits global TLS after weak certificate keys trigger browser distrust

 Illustration: AI-generated conceptual artwork; it does not depict a real certificate or intrusion. Eight eMudhra intermediate certificate authorities had private keys generated with too little randomness, making the keys recoverable and capable of signing fraudulent HTTPS certificates. India’s CERT-In says the affected P-384 keys were weak because of key generation; the P-384 algorithm itself was not broken. After browser vendors blocked the intermediates and Chrome announced it would remove their issuing root from its trust store, eMudhra said on Oct. 22 that it will leave the global SSL/TLS certificate business. Google says no TLS certificates chaining to the six affected TLS intermediates were logged in Certificate Transparency before Chrome blocked them. eMudhra says none of the eight intermediates issued end-user certificates, its infrastructure was not breached, and no data was lost. The company says seven intermediates were never deployed and the one used in production issued no certificates. Those statements indicate no confirmed misuse in the public record, while the key weakness still required a broad trust-store response. The broader root change can affect legitimate sites: Google plans to remove emSign ECC Root CA - G3 from Chrome’s trust store on Oct. 27 (PDT), and says sites whose certificates chain to it should move to another trusted hierarchy. eMudhra says it will replace affected customers’ certificates free of charge. CERT-In clarifies that India’s regulated digital-signature and eSign services are outside this incident’s scope. Two CVEs track software-side safeguards, not the original key-generation failure: [CVE-2026-111943](https://groups.google.com/g/golang-announce/c/66pojueaQek) adds a denylist in Go’s crypto/x509 verification, while [CVE-2026-113470](https://lists.debian.org/debian-security-announce/2026/msg00488.html) covers Firefox ESR packages that bundle the blocklist for users who cannot receive it through remote settings. See [Google’s response](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/), [CERT-In’s advisory](https://www.cert-in.org.in/s2cMainServlet?CACODE=CICA-2026-3649&pageid=PUBADV01) and [eMudhra’s transition plan](https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business).