The eMudhra Certificate Incident: What It Means for Your Website's SSL
Short answer
In October 2026, certificate authority eMudhra revoked eight intermediate certificates after a researcher found their private keys were extremely weak and could be recovered almost instantly. Mozilla, Google and Apple blocked them. eMudhra said most were not used in production and it found no evidence of misuse. For most businesses, the action is simple: confirm who issued your SSL certificate, keep browsers and systems updated, and use a reputable provider with automatic renewal.
Key takeaways
- ✓Weak keys made eight intermediates unsafe.
- ✓Major browsers blocked them.
- ✓Most websites are not directly affected.
- ✓Know your certificate issuer and renewal process.
Key facts
| Item | Detail |
|---|---|
| What | Weak private keys in eight eMudhra intermediate certificates |
| Found | 17 October 2026, by a security researcher |
| Response | Revoked; blocked by Mozilla, Google and Apple |
| Misuse | No evidence reported by eMudhra |
| Risk | Potential website impersonation if abused |
| Action | Update software; check your issuer |
What to check
- Open your site and view the certificate issuer.
- Confirm the certificate is valid and auto-renews.
- Update browsers and operating systems.
- Check apps or devices with their own certificate stores.
- Review security headers like HSTS.
- Monitor certificate transparency logs for your domain.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth AuditSSL best practices
- Use a well-known certificate authority.
- Automate renewal.
- Enable HTTPS everywhere with HSTS.
- Remove old certificates.
- Restrict who can request certificates.
- Set renewal alerts.
A worked example
Imagine a UAE online store that checks its certificate after the news. It is issued by a different authority and auto-renews, so no change is needed. The team also adds a calendar check every quarter and enables certificate monitoring.
How Husbar helps
Husbar checks websites for HTTPS, security headers and other trust signals that affect both security and conversions. Our funnel and sales page team can take this on end to end, or support your in-house team. book a free Growth Audit.
Questions to ask before you start
- Who issued our certificate?
- Does it auto-renew?
- Are our systems updated?
- Is HSTS enabled?
- Who manages DNS and certificates?
Key terms
- Certificate authority (CA): organisation that issues SSL certificates.
- Intermediate certificate: links your certificate to a trusted root.
- HSTS: header forcing browsers to use HTTPS.
Mistakes to avoid
- Ignoring renewal alerts.
- Using outdated devices or software.
- Not knowing who issued your certificate.
Why a fast, secure website is a sales tool
Your website is often the first serious impression a buyer gets. A slow, broken or hacked site loses trust in seconds, while a fast, clear and secure one quietly turns visitors into enquiries. Security, speed and conversion are not separate projects: they are all part of making the site earn its keep.
Read the website security checklist, PHP2Shell explained and website speed optimisation.
What happened with eMudhra?+
Eight intermediate certificates had weak keys and were revoked and blocked.
Is my website affected?+
Only if your certificate chains to the affected intermediates; check your issuer.
What should users do?+
Install browser and system updates.
Does this mean HTTPS is unsafe?+
No, the system worked by revoking and blocking the certificates.
How often should I check my SSL?+
Use monitoring and review at least quarterly.
Does Husbar build websites?+
We plan conversion-focused site structures and build landing pages, sales pages and funnels, and we can work alongside your developer on the rest.
How do I get a website review from Husbar?+
Book a free growth audit and we will review your site for clarity, speed, tracking and lead capture.
Sources
- [BleepingComputer: browsers block eMudhra certificates](https://bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates)
- [Business Today: MeitY on the eMudhra incident](https://www.businesstoday.in/technology/story/impact-has-been-very-limited-meity-on-emudhra-security-incident-says-indian-dsc-and-esign-unaffected-562927-2026-10-21)
Team Husbar
Husbar Editorial
Team Husbar is the strategy, psychology and research team at Husbar, a psychology-led growth agency headquartered in Dubai. Together we have worked with 100+ brands over 10+ years.
Want this applied to your brand?
We will find the psychology behind your lost sales and show you what to fix first.
Book a Growth Audit