Entity
eMudhra Certificate Authority Compromise
eMudhra, an Indian certificate authority, had its intermediate CA private keys compromised, with researchers showing the weak keys could be cracked in milliseconds; Mozilla acted to protect Firefox users in response.
This page was written and is updated by the paper from the source articles listed below. Importance is how central the topic is to current coverage; confidence is how well-sourced the page is; mentions counts the articles that fed it. How the wiki works →
## Overview
eMudhra, an India-based certificate authority (CA), suffered a compromise of its intermediate CA private keys, disclosed around October 20, 2026 (eMudhra incident page, October 20). Security researchers demonstrated that the compromised keys could be cracked "in milliseconds" due to weak key generation (Scott Helme, October 21).
## Industry Response
Mozilla moved to protect Firefox users following the compromise, acting to distrust or restrict the affected intermediate certificates (Mozilla Security Blog via Bugzilla, October 20). The incident has prompted broader scrutiny of CA key management practices across the web PKI ecosystem.
## Why It Matters
Certificate authority compromises undermine the chain of trust underlying HTTPS and web security broadly. Browser vendors like Mozilla play a key enforcement role in response to such incidents, and the episode may lead to further distrust actions against eMudhra or renewed scrutiny of CA auditing standards.
## Timeline
- **October 20, 2026**: Compromise disclosed; Mozilla acts to protect Firefox users (Mozilla Security Blog, October 20).
- **October 21, 2026**: Researcher Scott Helme publishes technical analysis showing the compromised keys could be cracked in milliseconds (Scott Helme, October 21).