eMudhra, a major Indian certificate authority, suffered two separate PKI failures in October 2026 — trivially recoverable private keys in its ECC hierarchy and mass revocations on its RSA hierarchy for missing required policy OIDs. Despite Mozilla and Chrome distrusting the G3 root, several Indian government sites under MeitY continue serving revoked eMudhra certificates days later.
Background
eMudhra is one of India's largest certificate authorities, widely used for government digital identity and secure communications. Root trust decisions by browser vendors like Mozilla and Chrome have cascading global impact on TLS security.
- Source
- Lobsters
- Published
- Oct 24, 2026 at 12:06 PM
- Score
- 7.0 / 10