National CERT tells Pakistani banks and ministries to act on eight compromised eMudhra keys
The advisory of 26 October came nine days after a researcher reported the keys to browser makers, which blocked them within days.
Pakistan's National Cyber Emergency Response Team told government departments, financial institutions and operators of critical digital systems on 26 October to treat eight compromised keys at the Indian certificate authority eMudhra as a live risk. The warning arrived nine days after a security researcher first reported the keys to browser makers.
Six of the keys were used for TLS certificates, which let a browser trust a website, and two for code signing, which vouches for software. The advisory warns that in the wrong hands such keys could be used to forge certificates, impersonate websites and online services, intercept traffic, spy on users and tamper with data.
What organisations are told to do
National CERT asked organisations to update operating systems, web browsers and software immediately, block the affected certificates and refresh their trust stores. It singled out mobile apps, desktop software and other systems that keep their own certificate stores, which do not always pick up a browser fix. Teams should also watch for suspicious certificates, unusual network activity and unexpected redirection of connections, and report any forged certificate or interception to National CERT Pakistan.
How the keys came to light
A researcher reported the problem on 17 October. Google says its Chrome Root Program blocked the affected intermediate certificates that day, and Mozilla logged the report at 20:06 UTC and shipped updated Firefox builds on 20 October.
eMudhra says it created the eight intermediate certificate authorities at a key generation ceremony on 30 April 2025, and that a script error left them with weak keys. It revoked all eight on 18 October. The flaw passed two independent audit cycles and went unnoticed for about 18 months, the company says.
“The flaw was ours.”
eMudhra says the eight intermediates had not issued publicly trusted certificates, that its infrastructure and customer data were not compromised, and that its digital signature and eSign products run on separate systems and are unaffected. Since 22 October it has offered certificates issued by Sectigo as an alternative.
Chrome drops the root
Chrome also moved against the root that signed the eight intermediates, emSign ECC Root CA G3. Google scheduled its removal from the Chrome Root Store for devices on 27 October, and told website operators whose certificates chain to that root to "immediately acquire and install a new TLS certificate" from another provider.
For Pakistani banks, ministries and software vendors, the job now is to find every certificate that chains to that root, replace it, and confirm that each device and application, not only the desktop browser, has received the update.
