# emSign / eMudhra Certificate Checker

> Free tool that checks whether a website's TLS certificate chains to the distrusted emSign ECC Root CA - G3 or to one of the eight revoked eMudhra intermediate certificates (October 2026 incident), and tests every key in the chain for weak-key patterns. Last updated 2026-10-22.

## Tool
- [Checker](https://emsign-check.automationvault.net/): enter a domain, or paste a certificate (PEM). Returns the chain and a verdict: Affected, Check needed, eMudhra not affected, or Not affected. Direct link format: https://emsign-check.automationvault.net/?d=example.com
- [Fix guide](https://emsign-check.automationvault.net/fix-emsign-certificate): what ACME is, and how to reissue with certbot, acme.sh, Caddy or cert-manager, install the new chain, and update trust stores.

## Key facts
- The private keys of eight eMudhra (emSign) intermediate CA certificates were P-384 integers smaller than 256, recoverable from the public certificates in under a second. One key was the number 4.
- Six intermediates were for TLS, two for code signing. All came from a key ceremony on 30 April 2025; eMudhra attributes it to a faulty script that created a second, weak set of keys with similar labels.
- Reported to root programs on 17 October 2026. Chrome (CRLSet) and Firefox (OneCRL) blocked them that day; eMudhra revoked all eight on 18 October; Sectigo revoked its cross-signs on 19 October.
- Mozilla removed emSign ECC Root CA - G3 in Firefox 158.0.1 / NSS 3.131.1 on 20 October 2026. Chrome removes it on 27 October 2026 (Chrome Root Store v43).
- eMudhra estimates about 30,000 certificates must move to its RSA chain; about 97% were issued via ACME.
- No misuse of the weak keys has been reported. Google said no TLS certificates chaining to the six TLS intermediates were logged in Certificate Transparency before the block.
- Revoked intermediate serials (issuer emSign Root TLS CA - G3 or emSign Root CS CA - G3): c7c41efe92d825f05eae841a4a82c1, 6cada367fb1c100088120ea202d568, a4aee678f23362b4c0e460b772f214, 8009928a64107601af05fa2f19f109, 296926c227a3a1526392b19482a504, 588b2e3c2bb8cda13e1a1209254321, 7818933f8f85b4619a2b35fba83d0a, 544b7f922c31ae220a4a922916f6e6.

## Sources
- Mozilla Bugzilla 2083449: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
- Help Net Security: https://www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
- Scott Helme: https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/