eMudhra says weak keys left eight emSign G3 CA keys recoverable
Original title: eMudhra Statement on Recent Certificate Security Incident
Browsers are phasing out emSign G1 trust in November 2026; eMudhra says the G3 intermediates issued no public end-entity certificates.
eMudhra said a script error issued eight emSign G3 intermediate TLS certificate authorities with weak, recoverable private keys. A researcher reported the flaw; the company confirmed it and revoked the intermediates within 14 hours. It says those intermediates had not issued publicly trusted end-entity certificates and that infrastructure and customer data were not compromised. About 30,800 affected G3 certificates belong to a US client ecosystem now using a G1 pathway, while browsers are scheduling distrust of emSign G1.
Unconfirmed: eMudhra says the intermediates issued no publicly trusted end-entity certificates and infrastructure was not compromised; KPMG's review is unfinished.
- Chrome and Firefox set emSign G1 SCTNotAfter to November 16, 2026.
- Apple removes G1 trust on November 30, 2026, including existing certificates.
- KPMG was named independent reviewer after an October 21 commitment.
- eMudhra says DSC, eSign and named enterprise products were unaffected.
- G1 TLS issuance is to stop once the US customer transition finishes.
Impact: Recoverable private keys for eight intermediate TLS CAs
| Product | Affected |
|---|---|
| eMudhra emSign G3 intermediate TLS CAs | eight intermediates |
| eMudhra emSign G1 | — |
- 1.Replace emSign G1-chained TLS certificates before the stated browser distrust dates.
- 2.Plan for Apple to distrust all G1-issued certificates after November 30, 2026.
- Vendors
- eMudhra
- Countries
- United States
From the original article
11 min read at emudhra.comSee also: https://bugzilla. mozilla. org/show_bug.
By emudhra.com via liberty · emudhra.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.