eMudhra appoints KPMG to review certificate failure as customers move away

eMudhra’s certificate-security incident has pushed customers toward replacement certificates and prompted broader trust removals by Microsoft. On October 30, 2026, eMudhra appointed KPMG to independently review the incident, adding outside scrutiny after it acknowledged weak security keys that went undetected for about 18 months, including through two independent audit cycles.

The appointment fulfills eMudhra’s October 21 commitment to commission an independent examination. The company says the review is intended to clarify the incident and help it address issues arising from it.

A replacement route, then an exit

In its October 28 update, eMudhra said roughly 30,800 certificates issued under the affected G3 hierarchies belonged to one customer ecosystem in the United States. That ecosystem was using an alternate issuance route through eMudhra’s G1 RSA root. The company has asked browser and root-store programs for time to complete the transition without disrupting member institutions.

G1 issuance is only a bridge. As part of its voluntary withdrawal from publicly trusted TLS services, eMudhra says it will stop issuing G1 TLS certificates when that customer transition finishes. It is also moving other TLS customers to alternate providers at no charge and says the vast majority have already switched.

The company says its digital-signature, eSign and enterprise services remain unaffected. Those services operate on separate infrastructure, so their customers do not need to take action over this incident.

Weak keys survived two audit cycles

The failure involved intermediate certificate authorities: issuing authorities beneath a trusted root. eMudhra says a researcher alerted it on October 17 to eight intermediates with weak, recoverable private keys. Those intermediates had been created during an April 30, 2025 key-generation ceremony. The company revoked all eight on October 18.

According to eMudhra, a step used to wrap and unwrap keys produced a second, weak set alongside the intended strong keys. The weak set was published to browser root stores. The company says certified hardware security modules were used; the failure was in the procedure, not the absence of that hardware.

eMudhra says the affected intermediates never issued customer certificates and that its investigation found no compromise of infrastructure or customer data. The customer impact instead followed distrust of the associated root. It has promised a full root-cause analysis explaining both the failure and why its controls missed it.

The company also said the researcher reportedly used AI-assisted tooling to reverse-engineer the weak keys. That is eMudhra’s description of the researcher’s methods, not an independently verified account of AI’s role.

Microsoft’s response reaches beyond the weak keys

Microsoft’s response included an October 26 Windows update removing six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list. It removed the same seven certificates from Edge’s trust list on October 27. Earlier blocks, issued October 20, targeted the affected authorities directly.

Microsoft describes six affected keys as TLS keys and two as code-signing keys, unlike eMudhra’s description of eight Global TLS intermediates. It warns that recoverable keys could enable website impersonation or make malicious software appear trusted.

Microsoft’s guidance for affected organizations

• Keep Windows certificate-trust updates and Edge component updates flowing, including to disconnected devices through managed update processes.
• Replace certificates dependent on the removed trust entries or obtain an alternative trusted chain.
• Do not restore trust locally without assessing the risk, especially where software may not reliably check revocation or Microsoft’s disallowed-certificate list.