Google and Mozilla have blocked compromised eMudhra certificate keys after a cryptographic failure affected part of the company's global TLS infrastructure. The practical impact depends on which eMudhra service is being used. India Digital Signature Certificate (DSC) and eSign services are not affected, according to CERT-In and eMudhra. The time-sensitive risk is for websites and services whose TLS certificates depend on the affected global trust chain, particularly before Google's planned removal of emSign ECC Root CA - G3 from the Chrome Root Store on October 27, 2026.

Are eMudhra DSC and eSign services affected?

No. CERT-In has explicitly separated eMudhra's Indian DSC and eSign operations from the global browser-trust infrastructure involved in the incident. India's DSC and eSign services are regulated under the Controller of Certifying Authorities framework and use infrastructure and cryptographic keys separate from the affected international TLS business.

An Indian user who uses an eMudhra DSC to sign documents, file forms or authenticate transactions should therefore not assume that the current certificate incident has invalidated that DSC. The same applies to eMudhra's India eSign service. The confusion exists because both businesses involve digital certificates, but they serve different purposes and operate through different trust frameworks.

What happened in the eMudhra certificate incident?

The incident concerns a set of eMudhra intermediate Certificate Authorities created under its public-trust infrastructure during a Key Generation Ceremony in April 2025. A flaw in the process produced weak cryptographic private keys with insufficient randomness. Those keys were later shown to be recoverable from their corresponding public information, which meant they could no longer be treated as securely secret.

Google responded by blocking the affected public keys in Chrome through its certificate-revocation system, while Mozilla blocked the affected TLS intermediates in Firefox and updated its trust infrastructure. These actions are protective: once a certificate-authority private key can be recovered, browsers cannot safely continue trusting certificates that depend on that key.

eMudhra has said its infrastructure itself was not compromised, no customer data was breached, and the incident did not affect its Indian DSC/eSign systems. The company also stated that the affected intermediates had not issued end-entity certificates. The incident is therefore better understood as a failure in certificate-key generation and trust, not as a conventional customer-database hack.

Will eMudhra websites or TLS certificates stop working after October 27?

Some websites could face certificate errors if their TLS certificate chain still depends on the root Google is removing. Google has announced that emSign ECC Root CA - G3, which signed the compromised intermediate certificates, is being removed from the Chrome Root Store, with the change expected to reach affected devices from October 27, 2026.

When Chrome visits an HTTPS website, it checks whether the site's certificate can be traced through a valid chain to a trusted root certificate. If the root is no longer trusted, Chrome may reject that certificate chain even when the website itself has not been hacked. Google has therefore warned that legitimate certificates still chaining to the removed root may cease to function unless they are migrated to another trusted PKI hierarchy.

This does not mean every eMudhra-related website certificate will fail. The key question is which root and intermediate chain a deployed TLS certificate uses. eMudhra has said it is working with affected subscribers to provide replacement certificates so that services can be migrated before browser trust changes create disruption.

Who needs to take action?

Most Indian DSC and eSign users do not need to replace their certificates because of this incident. Ordinary Chrome and Firefox users also do not normally need to manually remove certificates; browser vendors have already pushed protections through revocation and trust-store mechanisms.

The group that should act is website operators, IT teams and organisations using eMudhra/emSign TLS certificates. They should check whether their deployed certificate chains to emSign ECC Root CA - G3 or another affected intermediate and, where necessary, install a replacement certificate under a trusted hierarchy before browser support is withdrawn.

Organisations should also keep browsers, operating systems and trust stores updated. The relevant test is not simply whether a certificate was purchased from eMudhra, but whether the actual certificate path depends on the affected trust chain.

Why did eMudhra shares fall nearly 40% if DSC and eSign are unaffected?

The stock-market reaction is much broader than the immediate revenue exposed to the affected certificate business. eMudhra Limited (NSE: EMUDHRA, BSE: 543533) fell sharply after the incident became public even though the company said the affected global TLS operation contributes only around 1% of revenue.

The reason is that eMudhra operates in digital identity, PKI and trust infrastructure. For a company whose commercial proposition depends on cryptographic assurance and credibility with global browser ecosystems, a trust failure can have a larger valuation impact than the direct revenue of the affected product line. Investors are therefore trying to estimate potential reputational damage, customer hesitation, additional regulatory scrutiny and the effect on future international business rather than simply subtracting 1% from revenue.

The company's own statement acknowledged that reputational risks may exist and cannot currently be quantified. That uncertainty helps explain why the stock-market response can be much larger than the narrow revenue contribution of the affected certificates.

What should users and investors watch next?

The first near-term milestone is the October 27 Chrome Root Store change. Website operators still depending on the affected root need to ensure migration is completed. The second is the outcome of eMudhra's root-cause investigation and whether Google, Mozilla or other root-store operators take further action involving the company's remaining global certificate infrastructure.

Investors should separately watch for evidence that the incident has affected new customer wins, existing enterprise relationships or international revenue. Until those effects become measurable, the direct commercial impact and the broader reputational impact should not be treated as the same thing.

For Indian DSC and eSign users, the verified position remains much clearer: the current global TLS certificate incident does not affect India's DSC and eSign infrastructure based on the official CERT-In and eMudhra disclosures available as of October 22, 2026.

Frequently Asked Questions

What is the eMudhra certificate compromise?

The incident involved weak private keys associated with eMudhra intermediate Certificate Authorities used in its global public-trust infrastructure. Because those keys were generated with insufficient cryptographic randomness, they could be recovered and could no longer be treated as secure, prompting browser vendors to block the affected certificate chains.

Is the eMudhra certificate issue affecting Indian DSC users?

No. CERT-In and eMudhra have both stated that India's Digital Signature Certificate and eSign infrastructure is separate from the affected global TLS business and remains unaffected.

Was there an eMudhra certificate leak or customer data breach?

eMudhra says there was no compromise of its infrastructure and no customer-data breach. The security failure involved weak certificate-authority private keys generated during a key-generation process, which is different from a database leak or account breach.

Will eMudhra certificates stop working in Google Chrome?

Certificates that continue to depend on the affected emSign ECC Root CA - G3 trust chain may stop being accepted by Chrome after Google removes that root from the Chrome Root Store. Website operators using that chain should migrate to a replacement certificate.

What does the eMudhra certificate authority compromise mean for websites?

It means website administrators should verify the actual root and intermediate certificate chain used by their HTTPS certificate. If the deployed certificate depends on an affected or distrusted chain, it should be replaced before browsers stop trusting it.

Do eMudhra DSC or eSign users need to do anything?

For the current incident, ordinary Indian DSC and eSign users do not need to replace those services solely because of the global TLS certificate issue. Website operators using eMudhra/emSign TLS certificates have a different risk and should inspect their certificate chain.

This article will be updated on the same URL if Google, CERT-In, eMudhra or other major root programs announce a material change to the affected certificate status.

This article is for informational and educational purposes only.