Certificate authority

eMudhra (emSign): Indian CA and the 2026 key compromise

Last verified Nov 10, 2026

CCADB CA owner: eMudhra Technologies Limited
Country: IN
Country (CCADB): India
ACME: Yes
Free certificates: No
Products: DV OV EV S/MIME code-signing client document-signing
Roots: 6
Roots trusted for TLS: Chrome 1 · Mozilla 1 · Apple 2 · Microsoft 6
Intermediates under its roots: 83 (46 valid)
Auditor: BDO International Limited
CAA: emsign.com

Key points

eMudhra is an Indian digital identity company that runs the emSign certificate authority; CCADB lists the CA owner as eMudhra Technologies Limited, country IN.
On 2026-10-17 a researcher reported to the Chrome Root Program that private keys of eight eMudhra subordinate CAs had been generated with weak randomness; Chrome blocked them via CRLSet the same day.
Chrome removed emSign ECC Root CA - G3, the root that signed the compromised CAs, with the change expected to reach devices on 2026-10-27; CCADB now shows that root as 'Blocked' by Chrome.
On 2026-11-04 Google added that Chrome 153 and later will not trust certificates chaining to emSign Root CA - G1 whose earliest SCT is after 2026-11-16 23:59:59 UTC.
As of November 2026, Mozilla has removed emSign ECC Root CA - G3, C3 and Root CA - C1, while emSign Root CA - G1 remains included by all four major stores for now.

eMudhra is an Indian company whose emSign certificate authority issues TLS, S/MIME, signing and client certificates. In October 2026 the private keys of eight of its subordinate CAs were found to be compromised, and Chrome responded by blocking those CAs, removing the emSign ECC Root CA - G3 root and setting a cutoff for its other main root.

Owner and headquarters

The CCADB lists the CA owner as eMudhra Technologies Limited, with roots naming organization "eMudhra Technologies Limited" and country IN (India). emSign is the brand under which eMudhra sells its certificates.

Root certificates

As of November 2026, CCADB lists six emSign roots in the TLS report. emSign Root CA - G1 (RSA 2048, 2018–2043) is still trusted for TLS by Chrome, Mozilla, Apple and Microsoft. emSign ECC Root CA - G3 is "Blocked" in Chrome and removed by Mozilla, though Apple and Microsoft still include it. emSign Root CA - C1 and ECC Root CA - C3 have been removed by Chrome and Mozilla. The 2024 roots emSign Root TLS CA - G1 and G3 are so far only in Microsoft's store.

Certificate products

DV, OV and EV TLS certificates, S/MIME, code signing, client authentication and document signing certificates, sold through its CERTInext platform and partners.

ACME support

eMudhra's documentation describes ACME issuance through CERTInext with standard clients such as certbot or acme.sh, using an EAB key from the CERTInext dashboard and the emSign ACME directory.

Free certificates

eMudhra doesn't offer free publicly trusted TLS certificates.

Notable incidents

On 2026-10-17 at 18:05 UTC a security researcher reported to the Chrome Root Program that eight eMudhra subordinate CA keys had been generated with weak randomness, which would let anyone forge trusted certificates. Chrome confirmed it and pushed a CRLSet blocking the intermediates by 19:45 UTC; Android devices received an equivalent update through Google Play services. Google said no certificates from those CAs had been logged to Certificate Transparency before the block. Chrome then removed emSign ECC Root CA - G3, with the change expected on devices on 2026-10-27, and told site owners chaining to it to replace their certificates immediately. On 2026-11-04 Google added a distrust cutoff for emSign Root CA - G1 in Chrome 153: certificates whose earliest SCT is after 2026-11-16 23:59:59 UTC won't be trusted. Compare the gradual approach taken with Entrust in 2024.

CAA records

The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of eMudhra. One issue record with any of them lets eMudhra issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

Copy-ready record(s) for the first 1 domain(s):

example.com. CAA 0 issue "emsign.com"

Domain	Valid intermediates
`emsign.com`	64

For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator

Root certificates (CCADB)

eMudhra has 6 root certificate(s) in the CCADB TLS report. Together they have signed 83 intermediate CA certificates, 46 of them still valid.

Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.

trusted for TLS
included with limits (NotBefore / no TLS bit)
removed or blocked
not included

Root certificate	Key	Expires	Ch	Mo	Ap	MS	Intermediates
emSign ECC Root CA - C3	ECDSA P-384	2043-02-18	Removed	Removed	Not included	Included	9 (9)
emSign ECC Root CA - G3	ECDSA P-384	2043-02-18	Blocked	Removed	Included	Included	15 (3)
emSign Root CA - C1	RSA 2048	2043-02-18	Removed	Removed	Not included	Included	16 (16)
emSign Root CA - G1	RSA 2048	2043-02-18	Included	Included	Included	Included	10 (3)
emSign Root TLS CA - G1	RSA 4096	2049-02-07	Not included	Not included	Not included	Included	17 (8)
emSign Root TLS CA - G3	ECDSA P-384	2049-02-07	Not included	Not included	Not included	Included	16 (7)

Audits

Audit data the CCADB records for the TLS roots of eMudhra. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-05-31.

Audit	Scheme	Period	Statement	Report
Standard audit	WebTrust	2025-06-01 – 2026-05-31	2026-08-06	cpacanada.ca
Network security	WebTrust	2025-06-01 – 2026-05-31	2026-08-06	cpacanada.ca
TLS Baseline Requirements	WebTrust	2025-06-01 – 2026-05-31	2026-08-06	cpacanada.ca
TLS EV Guidelines	WebTrust	2025-06-01 – 2026-05-31	2026-08-06	cpacanada.ca

CP/CPS documents

Certificate Policy and Certification Practice Statement links that eMudhra has disclosed in the CCADB for its TLS roots, with effective dates:

CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.02.pdf (effective 2026-07-24)
Markdown CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.09.md (effective 2026-10-05)
Markdown CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.25.md (effective 2026-10-05)
Document repository: https://repository.emsign.com

Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels eMudhra lists in the CCADB (replace [at] and [dot] in addresses):

problem-reporting[at]emsign[dot]com

Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “eMudhra”:

Bugzilla: incident reports matching “eMudhra”

ACME directories (CCADB)

DV ACME directory URLs that eMudhra has disclosed in the CCADB for its valid certificates:

https://acme.emsign.com/v1/directory
https://acme-us.certinext.io/v1/directory

FAQ

My certificate chains to an emSign root. What should I do?

If it chains to emSign ECC Root CA - G3, replace it now with a certificate from another CA; Chrome no longer trusts that root. If it chains to emSign Root CA - G1, certificates first logged after 2026-11-16 won't be trusted by Chrome 153+, so plan to move to another CA before your next renewal.

What CAA record allows eMudhra to issue certificates?

Publish example.com. CAA 0 issue "emsign.com". The CCADB lists 1 recognized domain(s) for eMudhra: emsign.com.

Who audits eMudhra?

BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-06-01 to 2026-05-31; the statement is dated 2026-08-06.

How do I report a problem certificate to eMudhra?

Use the channel(s) listed in the CCADB: problem-reporting[at]emsign[dot]com.