eMudhra Certificate Keys Compromised: PKCERT Tells Pakistan to Update Before Chrome Drops emSign on 27 October

Eight intermediate certificate keys run by eMudhra (emSign) were found to be compromised, and Pakistan's National CERT told organisations on 21 October 2026 to update trust stores before Google removes the emSign ECC Root CA - G3 from Chrome, expected on 27 October. Everyday browser users are largely protected already. Website owners using an emSign certificate need to act.

A certificate authority (CA) is a company that vouches for a website's HTTPS padlock. If its private keys leak, an attacker can make a fake certificate for any site. We read Mozilla's security post, Firefox's release notes and the National CERT advisory on 22 October 2026.

Mozilla got a report of eight compromised keys on 17 October

Mozilla says it received a report on Saturday 17 October at 20:06 UTC that private keys for eight eMudhra intermediate certificates were compromised. Such keys could let an attacker issue fake HTTPS certificates for sites they do not control and read or change traffic if they can intercept a connection.

National CERT's advisory NCA-20.211026 adds that six of the eight issue TLS (website) certificates and two are used for code signing. It says the keys were made with too little randomness and were recovered by Mozilla within hours. Exploitation has not been publicly established.

Browsers blocked the keys within hours, so most readers need only an update

Mozilla blocked the eight certificates in Firefox on 17 October and finished delivering the block to standard Firefox installs in under three hours. It released Firefox 158.0.1 on 20 October for people whose settings may have blocked that update, and 158.0.2 for Android on 21 October.

National CERT lists further protections: a Chrome block list update on 17 October, Apple blocks on 19 October, Microsoft blocks on 20 October and a Google Play Services update on Android. The advisory states that Mozilla and Google confirmed their own steps directly, so treat the Apple and Microsoft dates as reported in the advisory.

Chrome is expected to remove the emSign ECC root on 27 October

The advisory says sites that depend on emSign ECC Root CA - G3 may fail once Google removes it from the Chrome Root Store, expected on 27 October 2026. It tells owners to get a new certificate from an unaffected issuer before that date.

That is the deadline that matters for a Pakistani business with an emSign-issued certificate. Google's own date is "expected", so check Chrome's announcements rather than assume the exact day. To see who issued your certificate, follow how to check a website's padlock and look at the issuer field.

Apps that keep their own certificate list are not fixed by a browser update

National CERT warns that updating a browser does not secure Java apps, Python environments, Node.js, Go programs, containers or devices that keep their own trusted-certificate list. These need their own library updates, or a rebuild in the case of Go programs.

The advisory lists fixed releases that it says come from a community remediation tracker, such as Go 1.27.3 and 1.26.10, Python certifi 2026.10.19 and Mozilla NSS 3.131.1. It tells readers to confirm each against the upstream project. We did not check every package, so do the same before you deploy.

1. Update your browsers and phone to the latest version.
2. Find which of your websites use an emSign certificate.
3. Order a replacement from another issuer before 27 October.
4. Update CA bundles in Java, Python, Node.js and containers.
5. Rebuild Go programs with a fixed Go release.

Ordinary users should update and keep an eye on certificate warnings

If you only browse, keep Chrome, Firefox, Edge and Safari updated and do not click through a certificate warning. A warning on a bank or government site after this incident is a reason to stop, not to continue.

Pair the update with safer login habits, such as a passkey on your Google account. Report suspicious redirects or a compromised system through PKCERT or NCCIA.

Why a certificate authority leak is serious

Browsers trust a short list of certificate authorities. If one authority's private key leaks, anyone holding it can sign a certificate that browsers accept as real. That is why browser makers act within hours, and why the fix is to stop trusting the affected certificates, not to wait for proof of abuse.

The risk is greatest where traffic can be intercepted, such as on a shared public network or through a rogue router. At home on a trusted connection the practical danger is small, which is one reason ordinary users are asked only to update. Organisations that handle payments, logins or official data carry more risk and should follow the steps above.

Common questions about the eMudhra certificate incident

What is eMudhra (emSign)?

It is a certificate authority, a company that issues the certificates behind HTTPS padlocks and code-signing. National CERT's advisory names it as the affected operator.

Was anyone attacked using the fake certificates?

Not as far as the sources show. National CERT says exploitation is not publicly established, and eMudhra reports its affected intermediates issued no legitimate end-entity certificates.

Do I need to do anything as an ordinary browser user?

Update your browser and phone. Block lists were pushed within hours, and Firefox shipped extra updates on 20 and 21 October.

When will Chrome remove the emSign root?

National CERT says it is expected on 27 October 2026. Treat that as expected, not final, until Google confirms.

Where do I report a security problem?

Send it to National CERT at cert@pkcert.gov.pk or through its incident portal.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked 22 October 2026. We read Mozilla's security blog post of 20 October, the Firefox 158.0.1 release notes and National CERT's advisory NCA-20.211026. We could not open Google's, Apple's or Microsoft's own pages, so the 27 October Chrome date and the Apple and Microsoft block dates come from the advisory. eMudhra's own statement was not available to us.