day · Oct 22, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 22, 2026
Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.
sourceeMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.
source
## summary
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
read the full incident →## advisories[5]
- eMudhra statement on certificate security incidenteMudhra · Oct 21, 2026
- Mozilla, Google, Apple block compromised eMudhra CA certificatesBleepingComputer · Oct 20, 2026
- OpenJDK Vulnerability Advisory: 2026/10/21 (CVE-2026-91403)OpenJDK · Oct 21, 2026
- Oracle Security Alert Advisory - CVE-2026-91403Oracle · Oct 21, 2026
- mitmproxy 12.3.0 release (removes eMudhra CAs)mitmproxy · Oct 22, 2026
