- Home
- eMudhra check
Does your SSL certificate come from eMudhra?
The keys of eight eMudhra intermediate authorities were recovered on 20 October 2026: anyone could forge certificates. Chrome and Firefox no longer trust the emSign ECC Root CA - G3 root, Chrome from 27 October. Enter your website: we read its certificate chain.
Passive check: a single TLS connection, like a browser.
A sound certificate does not make HTTPS safe
This check looks at one thing only: the authority that issued your certificate. The full audit checks the whole setup and tells you what to fix, in order.
Surface and SSL/TLS audit
Protocols, cipher suites, known flaws (Heartbleed, ROBOT…), HSTS and headers, grade from A+ to F and PDF report.
FreePrivacy audit
Cookies, trackers and consent: what your site sends to third parties before the visitor agrees.
1 KreditNon-destructive penetration test
Tests the known flaws of your web applications, with proof and a fix for each finding.
5 KreditsThe eMudhra case in short
eMudhra is an Indian certificate authority. A faulty script used during an April 2025 key ceremony produced weak keys that staff used by mistake for eight intermediate authorities: six for TLS certificates, two for code signing.
These keys were recovered and published on 20 October 2026. With them, anyone can issue a valid certificate for any website and intercept the traffic of software that still trusts these intermediates.
Chrome and Firefox have blocked the intermediates since 17 October; Firefox removed the emSign ECC Root CA - G3 root, Chrome removes it on 27 October 2026. Apple and Microsoft followed for the intermediates.
Software that ships its own certificate store (Node.js, Java, connected devices, old systems) may still accept these certificates: update it too.
What to do if your site is affected
- 1
Order a new certificate
From another authority (free Let’s Encrypt, Sectigo, DigiCert, GlobalSign…), with a new private key.
sudo certbot --apache -d example.com -d www.example.com - 2
Install the new full chain
Replace the certificate and intermediates on every server, load balancer and CDN, then run this check again.
- 3
Update your clients
Node.js 22.23.4, 24.22.1 or 26.12.1 and later, Java trust stores and embedded systems: they must reject the compromised intermediates too.
Frequently asked questions
Is the check really free?
Yes, no account and no limit other than a reasonable number of checks per quarter of an hour.
How do you recognise a compromised intermediate?
By the key identifier and name of the six TLS intermediates published with the disclosure (EM DV, OV and EV TLS CA - G3B and G3C), including their Sectigo cross-signed versions.
My eMudhra certificate is not compromised, should I still replace it?
Yes, soon. eMudhra is leaving the global TLS certificate market and Chrome is removing its ECC root: a certificate that depends on it will soon stop being recognised.
Does the check read my data?
No. It opens a TLS connection, reads the public certificate your server shows every visitor, then closes it.