Browsers moved fast on the eMudhra emSign G3 incident. Your Go services, Python scripts and Docker images may not have. Here is a short checklist for developers and sysadmins, based on what has been published so far.
What happened
- On 17 October 2026 a researcher reported that the private keys of eight eMudhra intermediate certificates could be recovered. Mozilla's preliminary finding is a key generation flaw: the keys were extremely small numbers instead of random values.
- Six intermediates were for TLS (EM DV, OV and EV TLS CA, G3B and G3C) and two for code signing (EM OV CS CA G3B and G3C). eMudhra revoked them on 18 October.
- Mozilla removed trust in the emSign ECC Root CA G3. eMudhra says about 30,000 certificates, most issued through ACME, need to move to chains under its G1 root.
Why your code is in scope
- Browsers block the bad chains, but many non-browser clients never check revocation lists.
- Services that ship their own trust store keep trusting what they shipped until you update and rebuild.
- The reverse problem also exists: genuine partner APIs still on emSign G3 chains may start failing TLS handshakes once trust stores update.
Checklist
- Inventory certificates on websites, load balancers, mail servers, VPNs and signing pipelines; flag anything chaining to emSign G3.
- Replace affected certificates and deploy the full new chain.
- Update Go to 1.27.3 or 1.26.10 and rebuild binaries.
- Update Python certifi, Rust webpki-roots and the Linux ca-certificates package in base images.
- Watch for fixes from Node.js and other runtimes.
- Run integration tests against payment gateways, government portals and partner APIs.
More detail: what Indian IT teams should do after the eMudhra CA key compromise
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
