Browsers already block eMudhra’s broken certificates. Your servers, containers and Go apps need an update to do the same

Browsers already stopped trusting them. The rest of your stack may not have. Eight intermediate certificates from the certificate authority eMudhra were made with private keys so weak that anyone could recover them and forge a trusted HTTPS certificate for any website.

Chrome, Firefox, Apple and Microsoft blocked them between October 17 and 20. Servers, containers, Go binaries, Java runtimes and Python tools that bring their own list of trusted certificates need an update before they stop trusting the forged ones.

Your browser already distrusts the broken eMudhra certificates. Your containers, Go binaries and Python scripts may not, until you update and rebuild them.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Eight eMudhra certificate keys could be recovered by anyone

A researcher known as Wayne reported on October 17 that he had signed a message with the private key of each of the eight intermediates. According to Mozilla’s incident report, cited by BleepingComputer, the P-384 keys were generated in April 2025 with values small enough to guess. eMudhra blamed an error in a key-generation script and revoked the certificates.

Google landed a CRLSet block within two hours of the report and says it will remove the emSign ECC Root CA – G3 root from the Chrome Root Store on October 27. Go released 1.27.3 and 1.26.10 to distrust the intermediates, tracked as CVE-2026-111943.

Servers, scripts and apps that carry their own certificate list

The incident site run by Mozilla engineer Dennis Jackson notes that no certificates from these intermediates appeared in Certificate Transparency logs, so browsers that enforce CT could not have been fooled. Many other clients do not check CT or revocation at all. That covers command-line tools, API clients and backend services, and they keep trusting the keys until their bundled store changes.

eMudhra says it found no evidence the intermediates were used to issue certificates to end users. The keys were recoverable from April 2025, though, and the incident site says it does not know whether attackers used them against clients outside the browser world.

Update ca-certificates, Go, Java, Node and certifi, then rebuild

• Update the ca-certificates package on Linux servers and base images (Ubuntu, Debian, Alpine, Fedora and others have shipped fixes), then rebuild and redeploy containers.
• Rebuild Go services with Go 1.27.3 or 1.26.10, and update Java (for example 21.0.13.0.2 or 17.0.21.0.2), Node.js (22.23.4, 24.22.1, 26.12.1) and Python certifi 2026.10.19.
• Restart long-running services so they reload the new trust store.
• If you run a site with a certificate chaining to emSign ECC Root CA – G3, replace it before Chrome drops that root on October 27.

Details

• Scope: eight eMudhra intermediate CAs, including EM DV TLS CA – G3B and EM OV TLS CA – G3C, chaining to emSign ECC Root CA – G3 and Sectigo cross-signs.
• CVE-2026-111943: Go crypto/x509 distrusts the compromised intermediates; fixed in Go 1.27.3 and 1.26.10.
• Other fixed versions listed by the incident site: NSS 3.131.1, curl CA bundle 2026-10-20, certifi 2026.10.19, pip 26.2.2, Electron 44.9.1, rustls-webpki 0.103.16.
• Browsers: blocked in Firefox and Chrome October 17, Apple October 19, Microsoft October 20.

Hunt / verify

• From each server or container, run curl against the test hosts listed on the incident site, which serve certificates from the compromised chains. A certificate error means that machine no longer trusts the bad intermediates; a page load means it still does.
• On macOS, the built-in curl, git and python3 read /etc/ssl/cert.pem without checking revocation; the incident site has a workaround.

Source: eMudhra incident site; CVE.org: CVE-2026-111943

Sources

• eMudhra Intermediate CA Compromise (incident tracking site)
• Google: Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates
• BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
• CVE.org: CVE-2026-111943
• Go: Release History

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].