Skip to contentistheinternetok
All incidents

Certificates·Major

eMudhra: 8 certificate authority keys leaked

MitigatedAffects website owners
eMudhra (emSign ECC Root CA - G3), Chrome, Firefox, Node.js

What it changes for you

Nothing to do; your browser already blocks the leaked certificates.

Secret keys behind eight eMudhra intermediate certificates leaked, which could have let someone fake the padlock of any website. Chrome, Android and Firefox blocked them within hours, so normal users are protected automatically.

Started Oct 17, 2026Updated Oct 21, 2026

Post on X

What should I do?

You
Nothing to do. Chrome and Firefox were protected automatically; Android users can restart their device to get the update right away.
If you run a website or an app
If your site's certificate chains to emSign ECC Root CA - G3, get a new TLS certificate from another trusted CA before October 27, 2026, when Chrome stops trusting that root. Update software that ships its own CA bundle.

What is affected

Timeline

  1. Mitigated · Oct 21, 2026

    Node.js security releases update the bundled CA store for the eMudhra compromise.

    nodejs.org

  2. Mitigated · Oct 20, 2026

    Google and Mozilla publish details. Google removes emSign ECC Root CA - G3 from the Chrome Root Store, rolling out to all devices on October 27, 2026. No certificate chaining to the affected CAs had been logged to Certificate Transparency before the block.

    Google

  3. Mitigated · Oct 17, 2026

    Firefox blocks the certificates through OneCRL for all users with standard settings.

    Mozilla

  4. Identified · Oct 17, 2026

    A researcher reports that private keys for eight eMudhra intermediate CA certificates are compromised. Chrome confirms and pushes a CRLSet block the same day.

    Google

Sources

Related