eMudhra's leaked CA keys, measured: 12 servers, all forged

The private keys of eight eMudhra intermediate CAs can be recovered from their own certificates: each is a P-384 key whose private key is a number below 256 (Mozilla bug 2083449, comment 11). A researcher reported it on October 17, with a message signed by all eight (the incident site). Six of them issue TLS certificates, EM DV TLS CA, EM OV TLS CA and EM EV TLS CA, each in a G3B and a G3C version, and two sign code, EM OV CS CA - G3B and EM OV CS CA - G3C. Sectigo had cross-signed all eight from its AAA Certificate Services root.

eMudhra revoked the eight on October 18 and Sectigo its cross-signs on October 19. Chrome and Firefox blocked them on the 17th, Microsoft on the 20th and Apple on the 22nd, the incident site says. Go and rustls-webpki shipped releases that refuse them (Go issue 82345, RUSTSEC-2026-0382).

That's the client side. We counted the servers with Web IP, which holds every host that answered on port 443 or 80 in our internet-wide scans, with its TLS certificate.

None before the report, 12 forged since

Web IP's pass of October 6 to 11 ended six days before the report. Of the 35,616,788 IPv4 addresses that presented a certificate on port 443 in it, none sent a chain through any of the 16 certificates: the eight intermediates and their Sectigo cross-signs.

The next pass ran from October 20 to 25 and reached 36,237,635 addresses. 12 of them served a leaf certificate signed by one of the eight, each a different certificate:

eMudhra issued no end-entity certificates from these intermediates (bug 2083449, comments 43 and 44), so every one of the 12 was signed by someone else holding a recovered key. Eleven carry start dates between October 20 at 00:59 and October 23 at 16:34 UTC. The twelfth claims to be valid from October 24, 2016, eight and a half years before the intermediate that signed it was created on April 30, 2025.

One of the 12 is the incident site's own test host, and five carry a demo name or a placeholder such as localhost. Three are made out to names that belong to two large web companies, on addresses in networks neither company runs. The 12 sit in 10 networks in 9 countries, 8 of the networks hosting providers.

Of the 14,045,887 top-list domains we fetch by name, none serves one.

Certificate Transparency logs hold many more. Bug 2083449's comment 44 counts 107,107 certificates signed with six of the keys logged between October 20 and 21, 106,050 of them for google.com alone. A logged certificate isn't a deployed one: 12 servers present one.

What it means for a defender

No legitimate server used the eight intermediates, before the report or after it, so blocking them breaks nothing. Block them by public key, as Chrome's CRLSet does: the 16 certificates share eight keys, and one block per key covers both the eMudhra and the Sectigo chain. The SHA-256 of each key's SubjectPublicKeyInfo, from the incident site's impacted-intermediates.json:

EM DV TLS CA - G3B   EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105
EM OV TLS CA - G3B   43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B
EM EV TLS CA - G3B   E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41
EM DV TLS CA - G3C   49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F
EM OV TLS CA - G3C   63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8
EM EV TLS CA - G3C   5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0
EM OV CS CA - G3B    EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6
EM OV CS CA - G3C    92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30

The clients that need it are the ones that get no revocation push or trust-store update. Certificate Transparency doesn't stop these forgeries, since they're logged too. That's anything that ships its own CA bundle, which the incident site says includes Electron apps such as Slack and Discord and, as of October 28, the git, curl and python3 Apple ships with macOS (its note). TLS-inspecting proxies, appliances, internal services and containers built on an old base image are in the same position. In those, a chain through one of these keys is an attack: nobody issues a legitimate certificate under them.

The root goes too: 1,298 InCommon servers

Mozilla announced on October 20 that it was removing trust in emSign ECC Root CA - G3, the root above the six TLS intermediates (bug 2083449, comment 18), and Chrome said it would do the same (comment 20). Google says it removed the root from the Chrome Root Store, with the change expected to reach all devices from the morning of October 27, Pacific time, and that some legitimate certificates under it will stop working in Chrome (Google's post).

Most of what sits under that root isn't eMudhra's own. InCommon, Internet2's certificate service for US research and education, issues through two intermediates under the same root, InCommon Intermediate CA - OVG3C and InCommon Intermediate CA - DVG3C. Of about 30,800 unexpired certificates in CT under the root, 30,791 are theirs, by the Chrome Root Program's count in comment 30 of bug 2083449. On the live internet:

• 1,298 IPv4 addresses presented a leaf from those two intermediates in Web IP's sightings of October 6 to 25, 1,176 from OVG3C and 122 from DVG3C. 1,144 of them still served it from October 20 on.
• All 1,298 are in the US, and 1,201 of them in networks typed as education in ASN.
• 209 of the 14,045,887 named domains serve one, 113 of them under .edu and 78 under .org.

The newest of these certificates was issued on October 20, and eMudhra has since stopped issuing under the root (comment 21). A site still on one fails in every Chrome that has taken the change, so it needs a certificate from another hierarchy.

eMudhra's own estate: 4,840 addresses, 78% in India

eMudhra's working certificates come from intermediates under its RSA root, emSign Root CA - G1, which Mozilla is keeping for now (comment 18). Leaving out the 12 forged ones, 4,840 IPv4 addresses present a leaf from an eMudhra or emSign intermediate, and 656 of the 14,045,887 named domains do. The largest intermediates are EM DV TLS CA - G2A-1 with 2,531 addresses, emSign SSL CA - G1 with 1,652 and EM OV TLS CA - G2A-1 with 557.

242 of the 2,916 .gov.in and .nic.in domains in the top list (8.3%) use eMudhra.

This estate needs a new CA too. eMudhra announced on October 22 that it is leaving the global TLS certificate business, keeping its G1 roots running until its customers have moved (eMudhra's announcement), and Google says it is reviewing whether eMudhra's remaining CA certificates stay in the Chrome Root Store. On October 19 eMudhra also revoked 9,356 certificates on the G1 hierarchy as "Superseded", a separate matter: the batch matches the certificates missing a policy identifier eMudhra's own rules require (Mozilla bug 2082782). captnemo.in counts 2,733 government domain names on certificates from that batch, 854 of them still serving the revoked one on October 23, which Firefox refuses and Chrome, whose CRLSet doesn't list them, still loads. We didn't check our 4,840 against the revocation lists.

Checking your own ranges

Web IP's cert_issuer_dn column holds each leaf certificate's issuer, so three filters over the ranges you own or protect find all three groups:

• CN=EM DV TLS CA - G3B and the other five TLS names above: a forged certificate.
• CN=InCommon Intermediate CA - OVG3C or DVG3C: a certificate that loses its root.
• An issuer naming eMudhra or emSign, other than the six above: a certificate that needs a new CA.

Joined to IP Country, IP ASN and ASN, the same filters count each group by country and network, as above. last_seen says when a host last answered, and cert_not_before the date its certificate starts.

How we counted

The pass before the report is every IPv4 address that presented a certificate on port 443 between October 6 and 11. Everything after it is Web IP's newest sighting of each address on port 443, between October 6 and 25: 40,867,132 IPv4 addresses, 36,237,635 of them seen from October 20 on. A chain counts as going through the eight when any certificate in it matches one of the 16 SHA-256 fingerprints in the incident site's impacted-intermediates.json, and the issuer names give the same 12. Named domains are the 14,045,887 top-list domains we fetch by name. A network is the address's origin network in IP ASN, typed by ASN, and a country is IP Country's. Mozilla's, Google's and captnemo.in's figures are theirs, as their pages read on October 27, and Google's and the incident site's pages were read again on November 2.

Getting access

Web IP is a gzipped CSV download, and its docs list the columns. Our launch post has what else it holds. To license it, see pricing or talk to us.