day · Oct 21, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 21, 2026
eMudhra published statements; Node.js security release refreshed CA store.
Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.
sourceIndia's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.
source
## summary
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
read the full incident →## advisories[5]
- eMudhra statement on certificate security incidenteMudhra · Oct 21, 2026
- Mozilla, Google, Apple block compromised eMudhra CA certificatesBleepingComputer · Oct 20, 2026
- OpenJDK Vulnerability Advisory: 2026/10/21 (CVE-2026-91403)OpenJDK · Oct 21, 2026
- Oracle Security Alert Advisory - CVE-2026-91403Oracle · Oct 21, 2026
- mitmproxy 12.3.0 release (removes eMudhra CAs)mitmproxy · Oct 22, 2026
