Mozilla and Chrome Distrust eMudhra's emSign ECC Root CA – G3: How a 30 April 2025 Key Ceremony Produced Eight Recoverable P-384 Keys and Ended in eMudhra's 22 October 2026 Exit From Global TLS

What happened between 17 and 22 October 2026

On 17 October 2026 an independent researcher sent Apple, Google, Microsoft, Mozilla and eMudhra proof that he controlled the private keys of eight eMudhra intermediate certificate authorities. Mozilla recovered the same keys on its own that evening and blocked the intermediates in Firefox within three hours of receiving the report. eMudhra revoked all eight the next morning. On 20 October Mozilla announced the emergency removal of trust in emSign ECC Root CA – G3, and Chrome said it would follow the same path. On 22 October eMudhra's board decided to leave the global SSL/TLS certificate business.

Why a key ceremony from April 2025 caused it

The keys came out of a key generation ceremony on 30 April 2025. Mozilla found that each of the eight P-384 private keys was an integer below 256, so anyone could find them by trying 256 values. eMudhra says the keys were made on FIPS 140-2 Level 3 hardware security modules and that a wrap/unwrap step in the ceremony produced a second, weak set of keys, which were the ones published. This post reconstructs the case from the root-program record and asks what it means for the post-quantum migration, which brings new key-generation and operational procedures into the Web PKI, with algorithms and certificate hierarchies differing by root program.