Short answer: eMudhra is trending because researchers found that the private keys behind 8 of its intermediate website-security and code-signing certificates were so weak that anyone could work them out from public data. Google, Mozilla, Apple and Microsoft have blocked those certificates. If you use an eMudhra Digital Signature Certificate (DSC) or eSign for ITR, GST or MCA filing, though, you're not affected. MeitY, CERT-In and the company all say Indian DSC/eSign runs on completely separate infrastructure and is working normally.
The news also sent eMudhra's share price down 20% to its lower circuit on 21 October 2026, and MeitY has set up a special team to investigate. Below we cover what went wrong in plain language, who actually needs to do something, and what changes around 27 October.
What happened with eMudhra, in one minute
eMudhra Ltd is a Bengaluru-based digital trust company, listed on NSE as EMUDHRA and on BSE as 543533. It runs two quite different businesses:
- Indian DSC and eSign: the digital signatures used for income tax, GST and company filings. These are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
- Global website certificates (TLS) under the emSign brand: the certificates behind the padlock in your browser. This business answers to browser makers like Google and Mozilla, not to the CCA.
The problem is entirely in the second business. On 30 April 2025, during a "key generation ceremony" under a root called emSign ECC Root CA – G3, a script error produced weak keys alongside the strong ones. The weak keys were the ones that got used. Those certificates passed audits and sat in browser trust stores for well over a year. Then a researcher (credited by Mozilla as "Wayne") reported the issue on 17 October 2026.
What is an intermediate CA certificate? A simple explanation
Think of website security as a chain of rubber stamps:
- Root certificate: the master stamp. Your browser or phone ships with a built-in list of roots it trusts.
- Intermediate certificate: a deputy stamp that the root authorises. Certificate authorities (CAs) use intermediates for everyday work so the precious root key can stay locked away offline.
- Website certificate: the stamp an intermediate puts on a specific site, such as yourbank.com, to say "this really is the site."
Every stamp has a secret private key. Whoever holds the key can stamp anything. If a criminal got hold of an intermediate's private key, they could in theory issue a fake certificate for any website, and browsers would trust it. That's why browsers moved within hours.
Which eMudhra certificates were affected
Eight intermediates, all chained to emSign ECC Root CA – G3:
- 6 TLS (website) intermediates: EM DV, OV and EV TLS CA – G3B and G3C
- 2 code-signing intermediates: EM OV CS CA – G3B and G3C (used to sign software)
Some of these also had copies cross-signed by Sectigo, another CA, and those copies were blocked too.
"The private key was the number 4": what that actually means
This detail made the story go viral. The keys use an elliptic-curve standard called P-384, so each private key should be a random 384-bit number, with roughly 115 digits. Guessing one should take longer than the age of the universe.
Instead, every one of the 8 private keys was a number below 256. Security researcher Scott Helme found that one key was literally 4, and he recovered all eight in under a second. Picture a bank vault with a 115-digit combination lock where the code turned out to be "0004."
The important point is that this was a bug, not a hack. Nobody broke into eMudhra. The keys were weak from the moment they were created. The company says its infrastructure wasn't breached and no data was lost.
Is your eMudhra DSC or eSign safe? Yes
This is what most Indian searchers want to know, and the official answer is clear:
- MeitY says DSC/eSign is "completely unaffected" and that impact on Indian websites was "very limited and for a very short interval." It also warned against "fear mongering" on social media.
- eMudhra says Indian DSC and eSign run on completely separate infrastructure and are working normally.
- The affected certificates belong to the global emSign TLS chain, not the CCA-regulated Indian signing hierarchy.
So your USB token, your Class 3 DSC and your Aadhaar-based eSign all work as before. You don't need to reinstall the DSC, buy a new token or re-register on the income tax, GST or MCA portals because of this incident.
One real risk for DSC users: scam calls
Fraudsters love a trending scare. If someone calls or messages saying your "eMudhra DSC has been compromised, pay to renew now," treat it as a scam. Neither eMudhra nor the government has asked DSC holders to replace anything. eMudhra says it is contacting the affected TLS customers (website operators) directly. If you've already lost money, here's how to report it on the 1930 cyber fraud helpline.
eMudhra certificate issue timeline
| Date | What happened |
|---|---|
| 30 Apr 2025 | Key ceremony creates 8 intermediates under emSign ECC Root CA – G3. A script error means weak keys are used. |
| Mid-2025 | The CAs enter browser trust stores. eMudhra says they passed WebTrust audits (by BDO) two years running. |
| 17 Oct 2026 | The issue is reported. Chrome blocks the 6 TLS intermediates within about 2 hours, and Mozilla blocks all 8 via OneCRL that night. |
| 19 Oct 2026 | Apple blocks them. Android gets a block via Google Play Services. |
| 20 Oct 2026 | Mozilla and Chrome confirm publicly and Microsoft blocks them. Fixes ship in Firefox 158.0.1, NSS 3.131.1 (removes the G3 root), Go 1.27.3/1.26.10 (CVE-2026-111943), Ubuntu, certifi and Homebrew. |
| 21 Oct 2026 | eMudhra files a statement with the BSE. The stock falls 20% to ₹432. CERT-In issues advisory CIAD-2026-0050, MeitY forms a probe team and Node.js patches ship. |
| ~27 Oct 2026 (expected) | Chrome removes emSign ECC Root CA – G3 in root store v43. Google is also reviewing emSign Root CA – G1. |
Was anyone actually harmed?
So far, there's no evidence of that. Here's what we know:
- Only 1 of the 8 CAs was in production, and none had issued end-user certificates, according to eMudhra.
- According to Chrome, none of these CAs had any certificates logged to Certificate Transparency (the public log browsers rely on) before the block.
- There's no evidence anyone exploited the weak keys. But because they could have been worked out since April 2025, the exposure window was long. That's why browsers are treating the problem seriously.
Ignore claims that "all 60 million eMudhra certificates can't be trusted." That's a misreading of the coverage. eMudhra says it has issued more than 60 million certificates in total, and only the 8 G3 intermediates are affected.
Will websites break? What changes around 27 October
For ordinary browsing, almost nothing visible changes, because so few certificates came from these CAs. Two groups should pay attention:
- Sites with certificates chained to emSign ECC Root CA – G3 need to switch before Chrome drops that root, expected around 27 October. After that, Chrome users will see security warnings on those sites.
- Sites relying on emSign Root CA – G1 should watch Google's review closely and have a backup CA ready.
Even eMudhra's own website returned a certificate error when we tried to fetch it during research, so you may run into hiccups on sites tied to these chains this week.
What to update or reinstall: a checklist
If you're an everyday user
- Update your browser (Chrome, Firefox 158.0.1 or later, Edge, Safari) and restart it.
- Install pending updates for your phone and computer. On Android, let Google Play Services update.
- Don't click through a certificate warning on a banking, tax or shopping site. Close the tab and try again later.
If you use a DSC or eSign
- You don't need to do anything. Keep filing as usual.
- Don't reinstall DSC drivers or tokens because of this news.
- Ignore anyone asking for money to "fix" or "renew" your DSC over this.
If you run a website or manage servers
- Check whether your certificate chains up to emSign ECC Root CA – G3. If it does, get a replacement from eMudhra (which says it is contacting customers) or another CA before about 27 October.
- Update
ca-certificateson Linux servers. Ubuntu has shipped fixes. RHEL packages were still pending at last check. - Update Go (1.27.3 / 1.26.10), Node.js, Python's certifi and NSS 3.131.1, then rebuild and redeploy your containers so old trust stores don't stick around.
- Remember that software which doesn't check revocation can still trust these chains. CERT-In names examples like the curl built into macOS and older Go builds. It warns of possible man-in-the-middle attacks and malware signed with the two leaked code-signing keys.
Why did the eMudhra share price fall 20%?
On 21 October, the stock opened at ₹520 against a previous close of about ₹540. It hit a high of ₹524.90, then fell to its 20% lower circuit and closed at ₹432. About 2.2 million shares traded at a VWAP of ₹456.47, leaving market cap around ₹3,580 crore. Market coverage calls it the sharpest one-day fall since listing. Sources disagree slightly on the previous close, so check NSE for official figures. The 52-week range is roughly ₹364.6 to ₹688.4.
Here are the facts investors are weighing. This isn't buy or sell advice.
- Small direct revenue hit: eMudhra says the global TLS business is about 1% of revenue. For context, Q1 FY27 consolidated total income was ₹192.46 crore and PAT was ₹32.0 crore (EPS ₹3.91).
- Hard-to-measure reputational hit: the company itself says the reputational impact "cannot be quantified." Trust is the product for a CA.
- Root trust risk: Chrome is dropping the G3 root and reviewing the G1 root. Losing more browser trust would matter more than the 1% revenue figure suggests.
- Regulatory overhang: MeitY's probe results are still to come.
If you're watching the wider market too, our explainer on why the Indian stock market is falling gives the broader context.
Myth vs fact
- Myth: eMudhra was hacked and data leaked. Fact: It was a key-generation bug. The company reports no breach and no data loss.
- Myth: My DSC is now invalid for ITR or GST. Fact: MeitY says DSC/eSign is completely unaffected.
- Myth: Every eMudhra certificate is untrusted. Fact: Only 8 G3 intermediates were blocked.
- Myth: Indian government websites were exposed for months. Fact: MeitY says impact on Indian websites was very limited and brief.
What to watch next
Over the coming days, watch for three things: Chrome's G3 root removal around 27 October, Google's decision on emSign Root CA – G1, and MeitY's probe findings. Data security stories tend to come in waves. If you followed our coverage of the SBI data leak probe, the advice is similar: rely on official statements over viral posts, and update your devices.
For more trending tech and online-safety explainers, visit the KyunTrend homepage.