Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

eMudhra revokes eight more CAs as browsers drop emSign G1

3 sources · 3 articlesFirst reported Updated ()
What's new

November 11: eMudhra says the weak G3 intermediates issued no public end-entity certificates. Chrome and Firefox set emSign G1 distrust for November 16, 2026, and Apple for November 30; about 30,800 G3 certificates belong to a US client moving to G1.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

eMudhra has revoked 16 intermediate CAs after a 2025 key-ceremony failure, and vendors are removing remaining emSign G1 trust in November 2026.

eMudhra revoked eight more intermediate CAs after it could not prove their RSA keys stayed in Utimaco HSMs during an April 30, 2025 ceremony, bringing the total to 16. A Python script had copied the keys onto a ceremony computer; the company told Mozilla on October 19 that the issuers were unaffected, and these eight are separate from weak emSign G3 intermediates revoked on October 18. eMudhra says those G3 issuers signed no publicly trusted end-entity certificates and that it knows of no misuse. The new revocations cover 195 TLS and code-signing certificates already replaced, while Chrome, Firefox, and Microsoft are set to remove remaining emSign G1 trust on November 16, 2026, and Apple on November 30. Cyber Security News reports about 30,000 certificates needed replacement; Lobsters cites about 30,800.

Key facts
  • Eight more RSA intermediates were revoked as cessationOfOperation, not keyCompromise.
  • Six issued TLS certificates and two issued code-signing certificates, covering 195 certificates.
  • Weak P-384 keys were reduced to values such as 4, 56, 66, and 237.
  • KPMG’s review is due December 4; the CA key inventory is due November 30.
  • The Hacker News says G1 issuance stops before November 16; Lobsters ties it to the US transition.
  • eMudhra says DSC, eSign, and named enterprise products were unaffected.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Apr 30, 2025Ceremony script copied RSA issuer keys from HSMs · The Hacker News
  2. Oct 17, 2026Researcher reported eight weak P-384 keys · Cyber Security News
  3. Oct 18, 2026First eight weak intermediates revoked · Cyber Security News
  4. Oct 19, 2026eMudhra told Mozilla eight issuers were unaffected · The Hacker News
  5. Oct 21, 2026eMudhra committed to an independent KPMG review · Lobsters
  6. Nov 16, 2026Chrome, Firefox, and Microsoft begin G1 distrust · Lobsters

What each outlet adds

beyond the shared facts
  • The Hacker News195 certificates, cessationOfOperation codes, and Mozilla’s October 19 assurance.
  • Cyber Security NewsWeak-key values, October vendor blocks, and about 30,000 replacements.
  • LobstersG1 distrust dates, no public end-entity certificates, and 30,800 count.
Vendors
eMudhraUtimaco
Products
emSign G3emSign G1emSignEM DV TLS CA – G2BEM DV TLS CA – G2CemSign Root TLS CA – G1emSign ECC Root CA – G3
Organizations
KPMGGoogleMozillaAppleMicrosoftOracle
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 8h ago The Hacker NewsFirst report

    eMudhra revokes 8 more CAs after RSA keys left HSMs

    It cannot prove the eight RSA issuer keys complied with its HSM rules, and lists 195 affected certificates.

  2. · 7h ago Cyber Security News

    eMudhra revokes eight more intermediate CAs after key review

    Those eight keys were not weak, but missing handling proof brings revoked intermediates to 16.

  3. · 1h ago Lobsters · security

    eMudhra says weak keys left eight emSign G3 CA keys recoverable

    Browsers are phasing out emSign G1 trust in November 2026; eMudhra says the G3 intermediates issued no public end-entity certificates.