---
title: eMudhra intermediate keys: CERT-In CIAD-2026-0050 and MeitY special team; company says weak keys from April 2025 ceremony, no end-entity certs issued | ctxsec
url: https://ctxsec.com/items/emudhra-meity-certin-ciad-2026-0050
description: ""
status: "confirmed (CERT-In CIAD-2026-0050 + MeitY officials to ThePrint/The Hindu; eMudhra statement)"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/emudhra-meity-certin-ciad-2026-0050.md)

confirmed (CERT-In CIAD-2026-0050 + MeitY officials to ThePrint/The Hindu; eMudhra statement)

2026-10-21

### eMudhra intermediate keys: CERT-In CIAD-2026-0050 and MeitY special team; company says weak keys from April 2025 ceremony, no end-entity certs issued

Follow-up to the Go/Firefox eMudhra intermediate distrust already on this site. On Oct 21 India's **CERT-In** published advisory **CIAD-2026-0050**: eight eMudhra intermediate CA private keys were generated with insufficient randomness (P-384 scalars smaller than 256, recoverable from the public keys); an attacker recovering them could forge TLS certificates. CERT-In says public disclosures do not establish confirmed malicious use as of that date, warns that removing the entire emSign ECC Root CA - G3 can break legitimate chains, and tells admins to update browsers/OS trust stores, replace affected chains, and never disable certificate validation. **MeitY** formed a special investigation team; officials say CCA-regulated Indian DSC/eSign services are unaffected and that the browser-trusted TLS business is under the global WebPKI framework. eMudhra's Oct 21 statement says the flaw was in a wrap/unwrap step of an April 30, 2025 key-generation ceremony on FIPS HSMs that published a second weak key set; seven of eight intermediates never ran in production, the one that did issued no end-entity certificates (per CT), roots were not compromised, and impact is limited to one US customer ecosystem whose certs are being replaced. Browser/OS distrust of the ECC root remains the practical control for everyone else.

Sources: [CERT-In Advisory CIAD-2026-0050](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0050) · [eMudhra statement (updated Oct 21)](https://emudhra.com/en/post/certificate-security-incident/) · [ThePrint: MeitY special team](https://theprint.in/tech/meity-sets-up-team-to-probe-emudhra-certificate-breach-says-digital-signature-services-unaffected/3078125/) · [Mozilla Bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)