Private key compromise of eMudhra intermediate certificates
This case concerns eMudhra’s disclosure that the private keys for 8 intermediate certificates were compromised and could be recovered. Mozilla received the report from an external reporter, confirmed proof of key control, and immediately began distrust actions for the affected certificates in Firefox via OneCRL. eMudhra later revoked the 8 impacted certificates with revocation reason caCompromise, and Sectigo completed revocation of the affected cross-signed CA certificates. Mozilla then disclosed the issue to impacted trust store operators and said it would release an unscheduled Firefox Release/ESR version bump to include the latest blocklist. On 2026-10-20, Mozilla requested that eMudhra cease issuance from all intermediates chaining to emSign ECC Root CA - G3 and migrate subscribers to alternative chains; eMudhra said it would do so immediately. Mozilla also stated it was not removing trust in emSign Root CA - G1 at that time.
- A report alleged that the private keys of 8 eMudhra intermediate certificates were compromised.
- eMudhra revoked the 8 impacted certificates with reason caCompromise.
- Mozilla began distrust actions for the affected certificates in Firefox via OneCRL.
- Sectigo completed revocation of the affected cross-signed CA certificates.
- Mozilla requested cessation of issuance from intermediates chaining to emSign ECC Root CA - G3 and asked for subscriber migration.
- Mozilla representative — Mozilla said it received the report, validated proof of key control, and started the process to distrust the certificates in Firefox via OneCRL.
- Community commenter — The reporter described the timeline, said the cross-signed certs were still unrevoked at that point, and noted no response from Microsoft.
- Mozilla representative — Mozilla said the impacted keys were trivially recoverable and asked eMudhra for details on hardware, key generation, and related incidents.
- Sectigo — Sectigo said it was preparing offline revocation of the cross-signed CAs within the next 24 hours.
- Emudhra representative — eMudhra said it had revoked all highlighted ICAs, stated the HSMs were FIPS 140-2 Level 3 compliant, and said it would investigate the KGC script.
- Sectigo — Sectigo said it had completed revocation of the affected cross-signed CA certificates.
- Mozilla representative — Mozilla said multiple people had independently recovered the private keys and requested emergency removal of trust in emSign ECC Root CA - G3.
- Emudhra representative — eMudhra acknowledged Mozilla’s request, said it would cease issuance from intermediates chaining to G3 immediately, and estimated about 30,000 certificates would need migration.