# eMudhra (emSign): Indian CA and the 2026 key compromise > eMudhra's emSign CA: roots, the October 2026 compromise of eight subordinate CA keys, Chrome removing ECC Root CA - G3 and a cutoff for Root CA - G1. Source: https://ssl.sh/cas/emudhra/ Last updated: 2026-11-10 eMudhra is an Indian company whose emSign certificate authority issues TLS, S/MIME, signing and client certificates. In October 2026 the private keys of eight of its subordinate CAs were found to be compromised, and Chrome responded by blocking those CAs, removing the emSign ECC Root CA - G3 root and setting a cutoff for its other main root. ## Owner and headquarters The CCADB lists the CA owner as eMudhra Technologies Limited, with roots naming organization "eMudhra Technologies Limited" and country IN (India). emSign is the brand under which eMudhra sells its certificates. ## Root certificates As of November 2026, CCADB lists six emSign roots in the TLS report. emSign Root CA - G1 (RSA 2048, 2018–2043) is still trusted for TLS by Chrome, Mozilla, Apple and Microsoft. emSign ECC Root CA - G3 is "Blocked" in Chrome and removed by Mozilla, though Apple and Microsoft still include it. emSign Root CA - C1 and ECC Root CA - C3 have been removed by Chrome and Mozilla. The 2024 roots emSign Root TLS CA - G1 and G3 are so far only in Microsoft's store. ## Certificate products DV, OV and EV TLS certificates, S/MIME, code signing, client authentication and document signing certificates, sold through its CERTInext platform and partners. ## ACME support eMudhra's documentation describes ACME issuance through CERTInext with standard clients such as certbot or acme.sh, using an EAB key from the CERTInext dashboard and the emSign ACME directory. ## Free certificates eMudhra doesn't offer free publicly trusted TLS certificates. ## Notable incidents On 2026-10-17 at 18:05 UTC a security researcher reported to the Chrome Root Program that eight eMudhra subordinate CA keys had been generated with weak randomness, which would let anyone forge trusted certificates. Chrome confirmed it and pushed a CRLSet blocking the intermediates by 19:45 UTC; Android devices received an equivalent update through Google Play services. Google said no certificates from those CAs had been logged to Certificate Transparency before the block. Chrome then removed emSign ECC Root CA - G3, with the change expected on devices on 2026-10-27, and told site owners chaining to it to replace their certificates immediately. On 2026-11-04 Google added a distrust cutoff for emSign Root CA - G1 in Chrome 153: certificates whose earliest [SCT](https://ssl.sh/glossary/sct/) is after 2026-11-16 23:59:59 UTC won't be trusted. Compare the gradual approach taken with [Entrust](https://ssl.sh/cas/entrust/) in 2024. ## Root certificates (CCADB) eMudhra has 6 root certificate(s) in the CCADB TLS report. Together they have signed 83 intermediate CA certificates, 46 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | emSign ECC Root CA - C3 | ECDSA P-384 | 2043-02-18 | Removed | Removed | Not included | Included | 9 | BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3 | | emSign ECC Root CA - G3 | ECDSA P-384 | 2043-02-18 | Blocked | Removed | Included | Included | 15 | 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B | | emSign Root CA - C1 | RSA 2048 | 2043-02-18 | Removed | Removed | Not included | Included | 16 | 125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F | | emSign Root CA - G1 | RSA 2048 | 2043-02-18 | Included | Included | Included | Included | 10 | 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367 | | emSign Root TLS CA - G1 | RSA 4096 | 2049-02-07 | Not included | Not included | Not included | Included | 17 | CEF71E70B7C29ADDF6C30CD19E614B38FD5F02A435A0EEDDD0087E183D101A51 | | emSign Root TLS CA - G3 | ECDSA P-384 | 2049-02-07 | Not included | Not included | Not included | Included | 16 | 7DD78D5F4F13459A83DFF9ABBBA62EDBAF6F2D102BF257FD712F4D9F2746ED8D | ## CAA records The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of eMudhra. One issue record with any of them lets eMudhra issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "emsign.com" ``` ## Audits Audit data the CCADB records for the TLS roots of eMudhra. Auditor(s): BDO International Limited. The most recent audit period ended on 2026-05-31. - Standard audit: WebTrust 2025-06-01 – 2026-05-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d8070c2-71d2-4f93-bd21-e79f18dbe93d) - Network security: WebTrust 2025-06-01 – 2026-05-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edaaaee5-c92d-4b44-a725-7b82d61194a1) - TLS Baseline Requirements: WebTrust 2025-06-01 – 2026-05-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=54ae9da3-4bdb-4d96-9081-ae5f5a10c2fe) - TLS EV Guidelines: WebTrust 2025-06-01 – 2026-05-31 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a47629e8-17c2-434b-a685-daf4d3c8328d) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that eMudhra has disclosed in the CCADB for its TLS roots, with effective dates: - CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.02.pdf - Markdown CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.09.md - Markdown CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.25.md ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels eMudhra lists in the CCADB (replace [at] and [dot] in addresses): - problem-reporting[at]emsign[dot]com ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “eMudhra”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=eMudhra&order=changeddate+DESC ## FAQ **My certificate chains to an emSign root. What should I do?** If it chains to emSign ECC Root CA - G3, replace it now with a certificate from another CA; Chrome no longer trusts that root. If it chains to emSign Root CA - G1, certificates first logged after 2026-11-16 won't be trusted by Chrome 153+, so plan to move to another CA before your next renewal. **What CAA record allows eMudhra to issue certificates?** Publish example.com. CAA 0 issue "emsign.com". The CCADB lists 1 recognized domain(s) for eMudhra: emsign.com. **Who audits eMudhra?** BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-06-01 to 2026-05-31; the statement is dated 2026-08-06. **How do I report a problem certificate to eMudhra?** Use the channel(s) listed in the CCADB: problem-reporting[at]emsign[dot]com. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).