Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

eMudhra exits global SSL/TLS after weak intermediate CA keys blocked

5 sources · 5 articlesFirst reported Updated ()
What's new

October 23: CSO Online adds free Sectigo replacements, Azul’s JDK block lists, and Google’s view that leftover risk requires traffic interception.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

eMudhra is exiting global SSL/TLS after browsers blocked eight weak intermediate CA keys it says issued no certificates.

eMudhra’s board voted on October 22 to leave the global SSL/TLS business after private keys for eight intermediate CAs were recovered. Researcher Wayne showed control on October 17; Mozilla recovered the keys and blamed insufficient randomness, and Google and Mozilla blocked the affected TLS keys and moved to distrust emSign ECC Root CA – G3. The company says it revoked those CAs within 14 hours, issued no end-entity certificates, and suffered no infrastructure or data breach; CERT-In reported no confirmed malicious use as of October 21. Mozilla has removed the root, while Chrome’s removal was expected on the morning of October 27. The Hacker News cites about 30,800 certificates in Chrome CT logs, while CSO Online says Google found none chaining to the blocked intermediates.

Key facts
  • Eight intermediate keys—six for TLS and two for code signing—had values under 256 bits.
  • Company says affected CAs were revoked within 14 hours and issued no end-entity certificates.
  • Global SSL/TLS is about 1% of revenue; G1 RSA roots remain during transition.
  • Free replacements include Sectigo for CertiNext users; revocation services run until expiry.
  • Azul added the eight certificates to its JDK block lists.
  • eMudhra still owes browser root programs a full root-cause report.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Researcher showed control of eight intermediate keys; browsers blocked them. · Cyber Security News
  2. Oct 21, 2026CERT-In reported no confirmed malicious exploitation. · Cyber Security News
  3. Oct 22, 2026Board approved voluntary exit from global SSL/TLS. · Lobsters
  4. Oct 27, 2026Chrome root-store change expected to reach devices. · Cyber Security News

What each outlet adds

beyond the shared facts
  • LobstersBoard date, 14-hour revocation, unaffected products, and owed root-cause report.
  • Cyber Security NewsWayne, sub-256-bit keys, CERT-In status, and TLS versus code-signing split.
  • The Hacker NewsKeys reported to five vendors; about 30,800 certificates in Chrome CT logs.
  • CSO OnlineSectigo replacements, Azul JDK lists, and no chaining certificates per Google.
Vendors
eMudhraSectigoAzulGoogleMozilla
Products
emSign ECC Root CA – G3Chrome Root StoreAzul ZuluAzul PrimeCertiNextemCAemSignerSecurePassemAS
Organizations
GartnerIDCSecurity BrigadeMozillaGoogleCERT-In
Countries
India

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Hacker News · securityFirst report

    eMudhra to exit global SSL/TLS certificate business

    A BSE filing says the firm will focus on enterprise solutions and trust services other than SSL/TLS.

  2. · 3d ago Lobsters · security

    eMudhra to exit the global SSL/TLS certificate business

    The company says affected CAs were revoked within 14 hours, with no end-entity certificates and no data breach.

  3. · 3d ago Cyber Security News

    eMudhra exits global SSL/TLS business after weak intermediate CA keys

    Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.

  4. · 3d ago The Hacker News

    eMudhra exits SSL/TLS business after weak CA keys found

    Researcher recovered private keys of eight intermediate CAs that were below 256 bits, leading to root distrust and business exit.

  5. · 2d ago CSO Online

    eMudhra exits global TLS market after intermediate CA keys compromised

    Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.