CA distrust only protects a client once its verifier consumes the update
A breakdown of the eMudhra incident: on October 17–18, 2026, Google and Mozilla distrusted intermediate certificates after weak P-384 key generation (private keys were integers below 256). Distrust reaches clients via OneCRL, CRLSet and root removal, and protects only those that have received the update.
- 8 of 24 eMudhra intermediates generated on April 30, 2025 had weak P-384 keys
- Chrome shipped a CRLSet update at 19:45 UTC on October 17; Firefox blocked at 22:59 UTC
- Chrome root removal of emSign ECC Root CA - G3 is expected October 27
- eMudhra revoked the eight certificates around 09:38 UTC on October 18
Read next
Security