Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Original title: Okta and Auth0 are removing trust in the eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
On October 17, 2026, a researcher reported that private keys for eight eMudhra intermediate authorities were generated with low entropy and could be derived from public certificates. Those keys can issue certificates for any domain that software trusting the eMudhra root will accept. Mozilla, Google, Apple, and Cloudflare blocked the intermediates. Mozilla removed emSign ECC Root CA – G3; Chrome will remove it on October 27, 2026. Okta and Auth0 are removing trust and report no exploitation.
Unconfirmed: Okta and Auth0 report no exploitation; the article does not say whether derived keys were used elsewhere.
- eMudhra has revoked the eight affected intermediates.
- Inbound Okta and Auth0 sign-in is not affected.
- Hooks, Auth0 Actions, and custom or federated connections are the cases to check.
- Endpoints fail after the tenant change if the chain still includes emSign.
- Chrome will remove the root on October 27, 2026.
Impact: issue trusted certificates for any domain
| Product | Affected |
|---|---|
| eMudhra emSign ECC Root CA – G3 | — |
- 1.Check servers Okta or Auth0 call for emSign in the certificate chain.
- 2.Replace any emSign certificate with one from another trusted CA.
- Products
- emSign ECC Root CA – G3
- Organizations
- MozillaGoogleAppleCloudflare
From the original article
1 min read at sec.okta.com
On October 17, 2026, a researcher reported that the private keys of eight intermediate eMudhra certificate authorities were generated with insufficient entropy and could be derived from their public certificates. Read on for Okta's response.
sec.okta.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.