eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers
eMudhra defends its response to a certificate compromise. Chrome says scrutiny does not justify delayed answers, and Mozilla shares its concerns. The company later apologizes for the key-generation flaw and promises an independent review.
Case period:
Published by The Dispute Index editorial teamPublished Updated
Overview
In its October 22 announcement (opens in a new tab), eMudhra says it handled the compromise diligently, revoked the affected intermediate CA certificates within 14 hours of discovery and disclosed promptly. It announced its exit from the global public TLS certificate business and offered transition support.
The Chrome Root Program (opens in a new tab) criticizes delayed answers to its questions. Mozilla's Dennis Jackson (opens in a new tab) says that, as of October 23, questions sent on October 20 had not been answered. The programs' criticism concerns responses to follow-up questions, rather than disputing the company's stated timing of initial notification.
The company's October 26 leadership note (opens in a new tab) apologizes for the key-generation flaw and promises a root-cause analysis and independent review. Its October 28 update describes customer transition plans.
The disagreement concerns the adequacy of the company's response after the compromise. The weak-key failure itself is acknowledged.
Timeline
7 timeline entries on this page. Dates: October 17, 2026 to October 28, 2026
October 2026
Researcher reports the key compromise to browser programs and eMudhra
Source release
The researcher's chronology records a report at 18:05 UTC and eMudhra's acknowledgement at 21:28 UTC.
[01]Bugzilla records the compromise report and initial revocations
The thread records the initial report, acknowledgement and revocations.
Bugzilla records the compromise report and initial revocationsComments 1-2: revocation confirmation and researcher chronologyMozilla records revocation of eight intermediate CA certificates
Source release
Dennis Jackson records that eMudhra marked the eight affected certificates revoked by 09:38 UTC.
[01]Bugzilla records the compromise report and initial revocations
The thread records the initial report, acknowledgement and revocations.
Bugzilla records the compromise report and initial revocationsComments 1-2: revocation confirmation and researcher chronologyMozilla sends follow-up questions about the compromise
Source release
Jackson's October 23 comment identifies October 20 as the date Mozilla sent its questions.
[02]Mozilla
Mozilla says that, as of October 23, it had not received answers to the questions sent on October 20.
Mozilla says eMudhra must uphold its obligations · MozillaComment 42 by Dennis JacksoneMudhra announces a public TLS business exit
Source release
The company announces withdrawal while defending its handling and arranging customer support.
[03]eMudhra
The company defends its handling and announces its planned exit from this business.
eMudhra announces exit from public TLS certificates · eMudhraOctober 22 release, chairman's account of the responseChrome and Mozilla criticize delayed replies
Reaction
The root programs say eMudhra must answer questions about the compromise.
[04]Google LLC
Chrome responds to comment 39 and criticizes delays in answering the root programs' questions.
Chrome Root Program criticizes eMudhra response delays · Google LLCComment 41, response to comment 39[02]Mozilla
Mozilla says that, as of October 23, it had not received answers to the questions sent on October 20.
Mozilla says eMudhra must uphold its obligations · MozillaComment 42 by Dennis JacksoneMudhra accepts responsibility for the key-generation flaw
Reaction
The leadership note apologizes for the key-generation flaw and promises a root-cause report and independent review.
[05]eMudhra
The company accepts responsibility, promises an independent review and describes customer migration.
eMudhra publishes leadership apology and transition updates · eMudhraLeadership note dated October 26; Update 6 dated October 28eMudhra updates its customer transition plans
Source release
The company describes migration steps for affected certificate customers.
[05]eMudhra
The company accepts responsibility, promises an independent review and describes customer migration.
eMudhra publishes leadership apology and transition updates · eMudhraLeadership note dated October 26; Update 6 dated October 28
Claims
Claims separate what was said from what is contested. Follow each source for the original wording and context.
What's disputed
Disputed claim
eMudhra
eMudhra handled the certificate compromise diligently and disclosed promptly.
What is disputed
The company defends its response; Chrome and Mozilla criticize delays in answering their questions.
Sources (3)
- eMudhra announces exit from public TLS certificates · eMudhraOctober 22 release, chairman's account of the response
- Chrome Root Program criticizes eMudhra response delays · Google LLCComment 41, response to comment 39
- Mozilla says eMudhra must uphold its obligations · MozillaComment 42 by Dennis Jackson
Response record
Responses
Choose one response filter, or select All responses to see the full record.
3 responses. Newest first.
Google LLCChrome Root ProgramDirectly involvedBefore this statement
Chrome's comment responds to comment 39.
"Offering it as an excuse conveys that reputation management is being prioritized over the obligations that eMudhra still owes to the billions of relying parties its mistake exposed. Those obligations do not relax because the consequences are uncomfortable."
CondemnedCase context: eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers
Full statement and sources
The Chrome Root Program rejects eMudhra's account of social media scrutiny as an explanation for delayed answers.
After the statement
The program then asks eMudhra to prioritize its review of the issue and its security response.
Chrome Root Program criticizes eMudhra response delays · Google LLCComment 41, response to comment 39Why this label?
Relative to the response after the compromise, Chrome criticizes delays in answering its questions.
This label describes the statement's response within the context above.
MozillaMozilla Root Program, statement by Dennis JacksonDirectly involvedBefore this statement
Dennis Jackson says Mozilla sent questions on October 20, allowed an initial 24 hours and had received no answers by October 23.
"We share the Chrome Root Program's concerns and whilst we appreciate eMudhra's difficulties, we expect eMudhra to uphold its obligations to Mozilla and the wider community."
CondemnedCase context: eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers
Full statement and sources
Mozilla says it had received no response to the questions it sent eMudhra on October 20. It shares Chrome's concerns and expects eMudhra to uphold its obligations.
After the statement
In comment 51, eMudhra says it has answered Mozilla's questions in direct correspondence.
Mozilla says eMudhra must uphold its obligations · MozillaComment 42 by Dennis JacksonWhy this label?
Mozilla criticizes the missed response deadlines and expressly shares Chrome's criticism of the response. Its acknowledgment of the company's difficulties does not express approval of the delay.
This label describes the statement's response within the context above.
eMudhraDigital trust companyDirectly involved Before this statement
The release attributes this account to chairman V. Srinivasan.
"eMudhra handled the recent incident diligently, revoking the affected CAs within 14 hours of discovery and disclosing promptly."
Defended or excusedCase context: eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers
Full statement and sources
eMudhra says it handled the incident diligently, revoked the affected CAs within 14 hours of discovery and disclosed promptly.
After the statement
It announces a business exit and continued customer support.
eMudhra announces exit from public TLS certificates · eMudhraOctober 22 release, chairman's account of the responseWhy this label?
It argues that its response after discovery was adequate.
This label describes the statement's response within the context above.
Sources
(5)
Official statement
eMudhra announces exit from public TLS certificates
Relevant passage: October 22 release, chairman's account of the response
About this source
The company defends its handling and announces its planned exit from this business.
- Published
- Accessed
Original text
Bugzilla records the compromise report and initial revocations
Relevant passage: Comments 1-2: revocation confirmation and researcher chronology
About this source
The thread records the initial report, acknowledgement and revocations.
- Published
- Accessed
Official statement
Mozilla says eMudhra must uphold its obligations
Relevant passage: Comment 42 by Dennis Jackson
About this source
Mozilla says that, as of October 23, it had not received answers to the questions sent on October 20.
- Author
- Dennis Jackson
- Published
- Accessed
Official statement
Chrome Root Program criticizes eMudhra response delays
Relevant passage: Comment 41, response to comment 39
About this source
Chrome responds to comment 39 and criticizes delays in answering the root programs' questions.
- Author
- Chrome Root Program
- Published
- Accessed
Official statement
eMudhra publishes leadership apology and transition updates
Relevant passage: Leadership note dated October 26; Update 6 dated October 28
About this source
The company accepts responsibility, promises an independent review and describes customer migration.
- Published
- Accessed
Share or embed this case
The embed keeps its attribution link to The Dispute Index. Credit the image to The Dispute Index and link to the case page.
Cite this record
- Publisher
- The Dispute Index
- Title
- eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers
- First published
- Last updated
- Permalink
- https://disputeindex.com/cases/emudhra-certificate-compromise-response-disclosure-dispute
The Dispute Index. "eMudhra says it handled certificate compromise diligently; Chrome and Mozilla criticize delayed answers". First published: 2026-10-29. Last updated: 2026-10-29. https://disputeindex.com/cases/emudhra-certificate-compromise-response-disclosure-dispute