Invothink Security check

Does this device still trust the compromised eMudhra CAs?

Your browser is testing itself against 14 certificates from the compromised CAs right now.

Check result

Starting check…

Connecting to the test sites.

Progress 0 / 14
Show details for each certificate

    This tests this browser only. Other apps on the same computer may use a different certificate list. The test servers count successful connections by client type and log nothing else.

    What happened

    On 17 October 2026, researchers recovered the private keys of eight eMudhra intermediate certificate authorities: six that issue website (TLS) certificates and two that issue code-signing certificates. The keys had been generated with weak randomness. Anyone with these keys can make a fake HTTPS certificate for any website, and a system that still trusts these CAs would accept it.

    Up-to-date Chrome, Firefox, Edge and Android already block these CAs. Systems at risk are mostly older or unpatched computers, and apps that keep their own certificate list (Java, Python, curl, some accounting and DSC utilities).

    This is an independent check run by Invothink and is not affiliated with eMudhra. The test servers belong to the community project we-have-a-problem.com. eMudhra states that its DSC signing and eSign services are not affected.

    What to do

    1. 1
      If the check shows a red alert, don't use this browser or computer for banking, GST or income-tax filing, or email until you have fixed it.
    2. 2
      Update everything: the operating system (Windows Update, macOS Software Update), your browser, Java, and your DSC token driver or signing utility. Then restart and run the check again.
    3. 3
      Check other apps. On the same machine, run this in a terminal or command prompt: 
      curl https://dv-g3b-emudhra.we-have-a-problem.com/
      If it prints “Your client successfully connected to the site.”, the system certificate store still trusts the compromised CAs. Step-by-step fixes for Windows, macOS, Linux and BSD are on the original advisory page.
    4. 4
      Still connecting? Contact your system administrator, or call Invothink on 97444 10015.

    Sources