eMudhra confirms compromise of private keys for eight intermediate certificates reported to Mozilla on 17 October 2026; eMudhra to exit global TLS business
Event summary
On 17 October 2026 Mozilla was notified that private keys for eight eMudhra intermediate certificates were compromised, a fact eMudhra confirmed publicly. Reuters/MarketScreener reporting states eMudhra will voluntarily withdraw from the global SSL/TLS certificate business. Operators should verify whether their certificate chains include those eight intermediates and plan replacements if they do.
CHRONOS Wire · October 24 · Alert 6
Publication details
- Published
- Updated
- Revision
- r1
- Source
- eMudhra
Cliff Notes
- Report to Mozilla on 17 Oct 2026: private keys for eight eMudhra intermediate certificates compromised; eMudhra announces exit from global TLS issuance market. Operators should check chaining and plan replacements.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
On 17 October 2026 Mozilla was notified that private keys for eight eMudhra intermediate certificates were compromised. eMudhra publicly acknowledged the incident and Reuters reporting says the company will withdraw from the global SSL/TLS certificate business. Site operators should check whether their certificates chain to those eight intermediates and plan remediation if so.
Why Urgent Level 3
Compromise of intermediate private keys can affect the trustworthiness of certificates that chain to those intermediates; operators using affected chains should determine exposure promptly so they can obtain replacements and restore trust in clients where necessary.
What Changed
eMudhra publicly confirmed that, per a report received by Mozilla on 17 October 2026, private keys associated with eight of its intermediate certificates were compromised. Separate reporting states eMudhra will withdraw from the global SSL/TLS certificate business.
What Is Genuinely New
eMudhra’s public statement confirming that Mozilla was notified on 17 October 2026 that private keys for eight intermediate certificates were compromised, and reporting that eMudhra will withdraw from the global SSL/TLS certificate business.
CHRONOS Bottom Line
Compromise of private keys for eight eMudhra intermediate certificates (reported to Mozilla on 17 Oct 2026) is publicly confirmed by eMudhra, and eMudhra has announced an exit from the global TLS certificate market; operators should verify whether their certificate chains include those intermediates and plan replacements as needed.
Uncertainties / Known Unknowns
Sources in the provided set confirm the report to Mozilla and eMudhra’s public statement plus reporting of market exit; the corpus does not include verbatim vendor distrust/revocation notices or documented incidence of misissuance or exploitation tied to the compromised keys.
Detailed Analysis
eMudhra’s statement gives a timestamp for the report to Mozilla (17 Oct 2026) and specifies eight compromised intermediate private keys. Independent reporting states eMudhra will withdraw from the global TLS/SSL certificate business. The provided excerpts do not include explicit, verifiable vendor distrusting/revoking actions or technical advisories directed at relying parties; therefore we do not assert vendor-wide revocations or immediate browser distrust without additional source excerpts documenting those actions.
Sources / Evidence
- 01eMudhra Statement on Recent Certificate Security IncidenteMudhra2026-10-23
- 02Indian firm eMudhra exits global digital certificates business after vulnerability disclosureReuters (via MarketScreener)2026-10-22
- 03Google, Mozilla revoke emudhra intermediates after private key compromiseCSO Online (reporting Mozilla/Chrome actions)2026-10-21
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.