Advisory on compromised eMudhra intermediate certificates

The eMudhra incident did not affect the security, validity or trustworthiness of any certificates issued by Sectigo to our customers. 

On October 19, 2026, Sectigo revoked the cross-certificates for the eight eMudhra compromised CAs. Sectigo has also revoked additional intermediate certificates it had cross-signed to eMudhra, ending the cross-signing relationship between the parties. 

Chrome and Mozilla have also removed the compromised CAs from their root stores. 

Sectigo has been referenced in connection with this incident because it had cross-signed the affected eMudhra certificates.  This cross-signing provided a compatibility bridge for eMudhra customers but has no impact on customers using certificates issued by Sectigo.

We want to emphasize that this incident did not involve any compromise of Sectigo systems, CA infrastructure, cryptographic keys, or certificate issuance operations.

For further information, please contact [email protected].