Incident · eMudhra intermediate CA keys · October 2026

Eight CA keys anyone could recover.

Eight eMudhra intermediate certificates were issued with private keys so weak they could be computed from the public certificate. Anything that still trusts them will accept a forged certificate for any website, or signed malware. Browsers have moved. Your servers, appliances and Java stores may not have.

Audit & remove with emudhra-remover → Why this matters ↓

    16 intermediate fingerprints
    7 trust-list removals
    Reported to vendors 17 Oct 2026
    Windows & Edge removals 26–27 Oct 2026
    Policy snapshot reviewed 3 Nov 2026
  

01 · Why it is dangerous

A certificate authority is a master key to the padlock.

When your browser shows a padlock, it is trusting a chain: the website's certificate was signed by an intermediate CA, which was signed by a root your device trusts. Whoever holds an intermediate's private key can sign a certificate for any domain, and every device that trusts that chain will believe it.

The eight eMudhra intermediates used P-384 keys whose private scalars were tiny integers, all below 256. That is not a key: it is a number you can guess in under a second. Several people independently recovered them after disclosure. No breach of eMudhra's servers was needed.

Microsoft's advisory describes the misuse this enables but does not say the keys were exploited. That is the uncomfortable part: no one can know. A forged certificate signed with a recovered key looks identical to a legitimate one.

6 × TLS

Impersonate any website

A forged TLS certificate for your bank, your mail server or your VPN gateway, accepted without warning by anything still trusting the chain. Encrypted traffic can be intercepted and read.

2 × Code signing

Sign malware as trusted software

Two of the keys were code-signing intermediates. Signed binaries pass checks that were designed to stop exactly this.

Revocation is not enough

Many clients never check

eMudhra revoked the intermediates, but embedded devices, Java applications and appliances frequently skip revocation. For them, trust ends only when the certificate is removed from the store.

02 · Who is affected

Your browser is fine. The rest of your network is the question.

Auto-updating platforms were patched within days. Everything that carries its own trust store, or does not receive updates, still trusts the compromised hierarchy until someone changes it.

01Patched by vendor

Windows, Edge, WebView2

Disallowed CTL updated 20 Oct; seven certificates removed from the trust list 26–27 Oct via out-of-band updates. Disconnected devices need the CTL distributed manually.

02Patched by vendor

Chrome, Firefox, Safari

Chrome and Mozilla removed emSign ECC Root CA – G3; CRLSet/OneCRL block the intermediates. Keep browsers updating.

03Check

Linux system CA bundles

Debian/Ubuntu ca-certificates, Fedora/RHEL trust. Depends on your distro shipping an update and you installing it. Editing the generated bundle is not persistent distrust.

04Exposed until fixed

Java trust stores

cacerts in every JDK/JRE and application-bundled JKS/PKCS12 stores. Eclipse Temurin removed the roots on 27 Oct; most deployed JVMs carry their own copy and were never told.

05Exposed until fixed

Appliances, IoT, media players

Anything with an application-owned PEM bundle, an EDK2 firmware CA collection or a vendor-frozen root store. Rarely checks revocation; often never updated.

06Check

Your own services

If any of your certificates chain to an eMudhra G3 hierarchy or the Sectigo AAA cross-sign, they will start failing as trust is removed. Reissue from another CA now.

03 · Vendor fixes

Take the vendor update first. Always.

Native OS and browser updates are the correct fix for anything that receives them. Keep automatic certificate trust updates enabled; for disconnected Windows fleets, distribute the updated Disallowed Certificate Trust List yourself.

Microsoft's response (MSRC) ↗

Windows

Out-of-band updates remove six eMudhra G3 roots and the AAA Certificate Services cross-sign; the Disallowed CTL blocks the eight intermediates.

KB5134133 · KB5134134 · KB5134130 · KB5134137 · KB5134140 · KB5134125 · KB5134124

Edge / WebView2

Same seven certificates removed from the Edge trust list on 27 Oct; CRLSet update delivered through component updates, no new browser version needed.

Automatic via component updater

Chrome

Removed emSign ECC Root CA – G3; reviewing emSign Root CA – G1.

Chrome Root Program

Mozilla

Emergency removal of emSign ECC Root CA – G3 after independent key recoveries; emSign Root CA – G1 retained for now.

Firefox / NSS root store

Java (Temurin)

Eclipse Temurin removed emSign ECC Root CA – G3 and Sectigo AAA Certificate Services from cacerts on 27 Oct. Other JDK vendors: check your release notes.

Reissue application-bundled stores yourself

04 · The list

23 SHA-256 fingerprints.

Snapshot of Microsoft's Trusted Root Program announcement of 26 October 2026. The 16 intermediate entries are the compromised keys (two certificates each). The 7 trust anchors are a broader distrust decision, not all compromised keys; one is Sectigo's AAA cross-sign.

Source announcement ↗

Compromised intermediates · 16

EM DV TLS CA - G3B TLS 42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493

EM DV TLS CA - G3B TLS 45a883f349aedfd5f3a649b5498ffb121712ba8b448f3f2a91dbc5a766fcddbe

EM DV TLS CA - G3C TLS 0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19

EM DV TLS CA - G3C TLS 62b7f9868263f72f6911fc78ceaf72c1979158b7368bf648683bb2aa39b02e72

EM EV TLS CA - G3B TLS e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838

EM EV TLS CA - G3B TLS 579480aea166290bd3c643589e795fc0d0e54e86505d180f1dff99efd3199512

EM EV TLS CA - G3C TLS 432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3

EM EV TLS CA - G3C TLS fd9d5c2dbbd4995ab69b8d50c439d9527b00529199c2fd01b2174eb58f07021f

EM OV TLS CA - G3B TLS 98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b

EM OV TLS CA - G3B TLS 5f1ded4dd590af74631290cf073b122a2aac6a1fa479778a0bd43579bd832699

EM OV TLS CA - G3C TLS cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f

EM OV TLS CA - G3C TLS 7485b51c0ed192878fa1d2f948fb529ae1842cc5086c4b67f7be5b2039de9489

EM OV CS CA - G3B Code signing 9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4

EM OV CS CA - G3B Code signing a496e23ac0cab8155fc9b117b97eae368efcbb9041aec8804d5a308d2d01c2d8

EM OV CS CA - G3C Code signing 4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1

EM OV CS CA - G3C Code signing 84112972b8e59d14560ae7e7119654474aad119990cf3722bfc1e3b91615e1fd

Trust-list removals · 7

emSign ECC Root CA - G3 Root 86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b

emSign Root Client Auth CA - G3 Root bbd8b3d745efb79198d93b9c482b9d934537325729ea2f02c129261f91be2e3d

emSign Root CS CA - G3 Root f2edaaff3d9b701fb4d14c9f285f8c0bad90fc3bcc1fa07d47f4718edaba34a5

emSign Root SMIME CA - G3 Root f76a0d440c418dc5b362be8e11e0a5d06023f4396093e4f455827bf55153d8a4

emSign Root TLS CA - G3 Root 7dd78d5f4f13459a83dff9abbba62edbaf6f2d102bf257fd712f4d9f2746ed8d

emSign Root TSA CA - G3 Root 75d2ce75979cf2a43b172c9f89f733dda2136031db4bbf3698b053714c077155

AAA Certificate Services (Sectigo cross-sign) Root d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4

Removing a root breaks legitimate certificates issued under it, including eMudhra customers who did nothing wrong. Microsoft is evaluating the remaining eMudhra roots separately; Mozilla removed emSign ECC Root CA – G3 and is keeping emSign Root CA – G1 for now.

05 · emudhra-remover

For everything the vendors don't reach.

An MCP server for Linux that lets your agent audit trust stores across your devices and remove the 23 fingerprints with a backup, a saved plan and verified rollback. Exact SHA-256 matching only. Audit mode by default. MIT licensed. No API key.

github.com/AndriGitDev/emudhra-remover ↗

controller · bash

# 1. install (Linux controller, Python 3.12+, uv)
git clone https://github.com/AndriGitDev/emudhra-remover.git
cd emudhra-remover
uv sync --frozen
cp examples/inventory.json inventory.json
# 2. edit inventory.json — only your own devices

# 3. run as a stdio MCP server, audit-only
EMUDHRA_INVENTORY="$PWD/inventory.json" \
EMUDHRA_STATE_DIR="$HOME/.local/state/emudhra-remover" \
EMUDHRA_ENABLE_WRITES=0 \
uv run --frozen emudhra-remover

inventory.json

{ "targets": [ {
  "id": "media-player",
  "transport": "ssh",
  "host": "192.168.1.30", "user": "admin",
  "adapter": "pem-bundle",
  "path": "/opt/media-player/certs/roots.pem"
} ] }

Then ask your agent

“List my configured devices, scan each trust bundle for the eMudhra incident policy, and show me removal plans with the affected certificates and store hashes.”

Set EMUDHRA_ENABLE_WRITES=1 only after reviewing the plan. Plans expire after 15 minutes; rollback never does.

Scan

scan_target reads one store and reports exact SHA-256 matches. Nothing changes.

Plan

plan_removal saves the original bytes and a bound plan in a private SQLite journal. Still nothing changes.

Apply

apply_plan rewrites atomically, preserves owner/mode/xattrs, verifies written bytes. Requires EMUDHRA_ENABLE_WRITES=1.

Rollback

rollback_plan restores the exact original if nothing else changed the file. Conflicts are never overwritten.

Adapters · v0.1

pem-bundle Application-owned PEM file Local or over SSH. Removes matching certificates.

openssl-trusted-bundle OpenSSL trusted PEM (X509_AUX) Adds an explicit anyExtendedKeyUsage rejection instead of deleting.

pkcs7 Unsigned PKCS#7 / P7B collection DER or PEM. Signed messages are rejected, not stripped.

debian Debian/Ubuntu ca-certificates Persistent package-root deselection plus native regeneration.

java-jks / java-pkcs12 Java trust stores Trusted-certificate entries only; needs a JDK 17+ on the controller.

nss-sql Closed NSS cert9.db Native certutil distrust; empty password, no private keys, app closed.

edk2-cacerts EDK2 HTTPS certificate collection File remediation only; no firmware variable access.

06 · What this does not do

“No matches” is not “you are safe.”

×It removes exact fingerprint matches from the configured store. It does not install an SPKI denylist, implement revocation checking, or find alternate certificates carrying a compromised key.
×It cannot prove every application on a device is protected. Applications cache trust; nothing is restarted for you.
×Removing an entry from a generated bundle like /etc/ssl/certs/ca-certificates.crt is not persistent OS distrust. Use the debian adapter or your distribution's native mechanism.
×Windows, macOS, Fedora/RHEL native stores, Android, iOS and immutable firmware are not covered. Vendor updates are the fix there.
×Firefox built-in roots and most personal browser profiles are out of scope; the NSS adapter is deliberately narrow.
×A compromised SSH target can lie about its own audit. There is no remote attestation.
×The write flag allows apply and rollback; it does not prove a human approved anything. Configure approval in your MCP client.

07 · FAQ

Plain answers.

I just use a laptop and a phone. Do I need to do anything?+

Let your operating system and browser update. Windows, Edge, Chrome, Firefox and Java distributions have already shipped fixes. This page and the tool are for people who run servers, appliances or devices that do not update themselves.

Were the keys actually abused?+

Unknown. Microsoft's advisory describes what the keys would allow but does not establish exploitation. A certificate forged with a recovered key is indistinguishable from a real one, which is why trust is being removed rather than waiting for evidence.

eMudhra revoked the certificates. Isn't that enough?+

Only for clients that check revocation, and many do not: embedded devices, older Java applications, appliances. For those, trust ends when the certificate leaves the store.

Why are roots being removed if only intermediates were weak?+

Root programs decided the hierarchy could no longer be relied upon, which is a broader trust decision than blocking eight known keys. That decision has side effects: legitimate eMudhra certificates break too, and the Sectigo AAA cross-sign is included because it signed the weak keys.

Can the tool damage my system?+

It is designed not to: audit mode by default, exact-byte backups before any write, atomic replacement, verified rollback, and refusal to overwrite anything changed by someone else. Still, use a maintenance window and read SECURITY.md first. No real device was modified during development.

Does it need an AI model or send data anywhere?+

No. It is a local stdio MCP server; whichever client you already use drives it. There is no HTTP endpoint, no telemetry and no network feed that can change the bundled policy.

Audit your fleet today.

Start in audit mode. Read every plan before you enable writes. Keep the state directory: it is your rollback.

Get emudhra-remover ↗

Independent of eMudhra, Microsoft and MCP client vendors. Security issues: report privately via the repository owner's GitHub profile.