On 17 October 2026, a security researcher showed that the private keys behind eight intermediate certificates run by eMudhra, the Bengaluru-based, publicly listed certificate authority, were weak enough to be recovered. Within hours Chrome and Firefox blocked them. By 22 October eMudhra had said it would wind down its global SSL/TLS certificate business. If your startup's website, API or app backend uses an eMudhra certificate, this is the week to check it, and every founder can use the moment to fix how certificates are tracked.
This guide gives you a short check you can run today, what the reports actually say, and what to change so that the next certificate problem does not surprise you. It is a practical method, not legal or security advice for any specific setup.
What happened, in plain terms
A TLS certificate is what puts the padlock on your site. Browsers trust it because it chains up through an intermediate certificate to a root certificate that the browser already trusts. If someone holds the private key of a trusted intermediate, they can issue convincing certificates for any domain.
That is the risk the researcher found. According to Google's Chrome Root Program, the report arrived at 18:05 UTC on 17 October, and the keys "were generated with insufficient randomness". Chrome pushed a CRLSet update at 19:45 UTC that blocked the affected intermediates without needing a browser update. Mozilla says it received the report at 20:06 UTC and finished blocking the certificates in Firefox, through its OneCRL list, in under three hours. BleepingComputer reported that Apple also blocked the certificates.
Google also removed the root that signed these intermediates, emSign ECC Root CA - G3, from the Chrome Root Store, and warned that some legitimate certificates chaining to that root will stop working in Chrome. Mozilla is removing the same root from its NSS trust store.
Two facts reduce the panic. eMudhra told Inc42 it revoked the affected CAs within 14 hours, that none of the eight issued certificates to end users, and that no data was breached. Google says no TLS certificates chaining to the affected intermediates were logged to Certificate Transparency before the block, so Chrome users were not exposed to forged certificates from them. There is no public evidence that the weak keys were abused.
Why Indian startups should still check
The second part of the story affects ordinary customers. eMudhra told Inc42 it would exit the TLS business, move existing customers to other certificate providers free of charge over the following three to four weeks, and work with partners to avoid disruption. It also said certificates in India were issued from its G1 RSA root, which continued to operate at the time of that interview, while the distrusted root was the G3 ECC one.
So most Indian sites on eMudhra certificates are probably not broken today. But a certificate whose issuer is leaving the market is a renewal you cannot postpone, and you want to choose the replacement yourself rather than find out from a browser warning.
The announcement covers SSL/TLS certificates. Digital signature certificates (DSCs) that founders use for MCA and GST filings are a separate product. The reports we reviewed did not say those are affected; if you use an eMudhra DSC, read eMudhra's own customer notices instead of assuming either way.
The 20-minute certificate check
Step 1: List every hostname you own
Start with more than your homepage. Write down the marketing site, the app (for example app.yourdomain.in), the API, the admin panel, mail and webmail hosts, payment or webhook callback URLs, and any staging hosts that customers or partners can reach.
Then search Certificate Transparency logs at crt.sh for your domain. Every publicly trusted certificate is logged there, so you will often find hosts that nobody on the current team remembers.
Step 2: Read the issuer for each host
In a browser, open the padlock, then the certificate details, and look at "Issued by". From a terminal, this prints the issuer and expiry date:
echo | openssl s_client -connect yourdomain.in:443 -servername yourdomain.in 2>/dev/null | openssl x509 -noout -issuer -enddate
Look for "eMudhra" or "emSign" in the issuer line. If you see an ECC "G3" chain, assume it already fails in Chrome and replace it first.
Step 3: Check the servers you do not see
Your users see the edge certificate, but your systems also trust certificates when they call out. Cloudflare's write-up on the incident says customers using its Full (strict) mode should review the certificates on their origin servers, and that teams should update shared trust stores and base images, then reload or restart services so the change takes effect. For a small team that usually means:
- updating the operating system's CA certificates package on each server;
- rebuilding Docker images on a fresh base image, not only restarting old containers;
- checking mobile apps that pin a certificate or a specific CA, because a pinned eMudhra chain will break when you switch.
If a partner API you call presents an affected chain, your calls may start failing after these updates. Log TLS errors separately so you can tell that apart from an outage.
Step 4: Replace, test, then remove
Pick the replacement before the old certificate expires or is revoked. Let's Encrypt issues free certificates through the ACME protocol, and many hosting providers already obtain and renew them automatically. Its getting-started guide suggests checking that first and running an ACME client such as Certbot only if your host does not. A paid certificate from another CA is also fine if a customer contract asks for organisation validation.
After switching, load each hostname in Chrome, Firefox and Safari, test the full chain with the same openssl command, and only then remove the old certificate and any pinned values.
The bigger change: certificates are getting shorter
eMudhra's cofounder told Inc42 that browser rules moving towards short-lived certificates hurt the business case for selling TLS certificates. Founders should read the same trend as a deadline for themselves. In April 2025 the CA/Browser Forum adopted ballot SC-081, which cuts the maximum lifetime of public TLS certificates to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Every major browser maker voted yes, and so did eMudhra.
At 47 days, a certificate renewed by hand from a calendar reminder will eventually be missed. Automated renewal stops being a nice extra and becomes basic hygiene.
Keep a one-page certificate register
One shared table removes most of the risk:
| Hostname | Issuer (CA) | Expires | Renews how | Owner | Pinned anywhere? |
|---|---|---|---|---|---|
| yourdomain.in | Let's Encrypt | 2026-12-20 | Host auto-renew | Founder | No |
| api.yourdomain.in | (fill in) | (date) | ACME on server | Backend lead | Android app |
Review it monthly, and add a row whenever someone creates a new subdomain. If you already keep a list of compliance claims for buyers, put this next to it. Our guides on checking a CERT-In audit claim and verifying an ISO certificate use the same habit: write down what the document proves and when you checked it.
Checklist
- List every public hostname, including APIs, mail and callback URLs.
- Search crt.sh for certificates you forgot about.
- Read the issuer and expiry date for each host.
- Replace any eMudhra or emSign certificate, G3 ECC chains first.
- Update CA bundles and rebuild container images on your servers.
- Check mobile apps for certificate pinning before switching.
- Turn on automated renewal and keep a one-page register.
FAQ
Is my website unsafe if it uses an eMudhra certificate?
Not necessarily. The compromised keys belonged to intermediate certificates, and eMudhra says they did not issue end-user certificates. The practical issue is continuity: G3 ECC chains are distrusted in Chrome, and eMudhra is leaving the TLS business, so you need a new provider.
Do I have to pay for a replacement certificate?
No. Free certificates from Let's Encrypt are trusted by all major browsers, and eMudhra has said it will move existing customers to other providers free of charge. Pay only if a customer or regulator asks for a specific validation level.
Does this affect my digital signature certificate for MCA filings?
The announcements we reviewed are about SSL/TLS certificates for websites. Check eMudhra's own notices if you hold an eMudhra DSC.
The practical rule
A padlock is a dated claim, just like an audit certificate. Know who issued it, when it expires and who renews it, and an incident like this becomes a routine afternoon instead of an outage. Founders listing a company can submit it to SuperLaunch with claims their records support. Readers can browse the directory and see our editorial policy for how we handle sources and corrections.
Sources checked on 24 October 2026
- Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates (20 October 2026)
- Mozilla Security Blog: Protecting Firefox users following the compromise of eMudhra intermediate certificates (20 October 2026)
- Cloudflare: 8 eMudhra certificates are compromised. Here's what you need to know
- Inc42: eMudhra to exit certificate business as security flaw triggers distrust (22 October 2026)
- BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates (20 October 2026)
- CA/Browser Forum: Ballot SC-081v3, schedule of reducing validity periods
- Let's Encrypt: Getting started
