Digital security · Tax compliance

eMudhra certificate compromise: what DSC users should know

Eight eMudhra intermediate certificates were compromised and revoked. The published list covers website encryption and software signing—not individual tax-filing DSCs.

By CA Arvind Mehta · 21 October 2026
← Back to all articles

Mozilla disclosed on 20 October 2026 that private keys for eight eMudhra intermediate certificates had been compromised. That is a serious certificate-authority incident, but the published evidence does not say that every eMudhra certificate—or the usual USB-token DSC used to sign an Income Tax or GST filing—has been compromised.

The practical answer for most tax filersDo not replace or revoke an otherwise valid USB-token DSC solely because of this incident. Keep your browser and operating system updated, never bypass a certificate warning, and act if your own DSC is shown as revoked, lost, expired or otherwise compromised.

What happened?

Mozilla says it received the report on 17 October at 20:06 UTC. The exposed private keys could have been used to issue fraudulent HTTPS certificates. If an attacker could also intercept a connection, that could enable website impersonation and the reading or modification of traffic.

Mozilla blocked the affected certificates through OneCRL, completing distribution to standard Firefox configurations by 22:59 UTC—less than three hours after receiving the report. eMudhra marked all eight affected certificates as revoked on 18 October at 09:38 UTC, with the reason recorded as a certificate-authority compromise.

The public incident record identifies six TLS intermediates and two code-signing intermediates. The six TLS certificates were trusted through major browser root programmes; the other two were for code signing. Mozilla also published Firefox 158.0.1 for desktop and Android, plus ESR 115.43.1 and ESR 153.5.1, for users whose custom settings might have prevented the automatic OneCRL protection.

Website certificates and tax-filing DSCs are different

TLS and code-signing certificates

TLS certificates help a browser authenticate a website and encrypt the connection. Code-signing certificates help verify that software came from a stated publisher and has not been altered.

Subscriber DSC on a USB token

This is the personal or organisational certificate used to sign an Income Tax return, statutory form, GST filing or other electronic record.

India’s Controller of Certifying Authorities requires SSL and code-signing certificates to be issued from a special-purpose trust chain. The eight names in the public incident record are expressly TLS or code-signing intermediates. The Income Tax Department, by contrast, describes the filing DSC as a valid Class 2 or Class 3 certificate on a USB token obtained from an Indian Certifying Authority.

On that published evidence, the affected list does not include the ordinary subscriber DSC chain used to sign tax filings. This is a scope conclusion from the certificates disclosed—not a blanket assurance about every eMudhra product or a substitute for a later notice from eMudhra, the CCA or a government portal.

Who should take action now?

  1. Every browser user: install current browser and operating-system updates. Firefox users should be on 158.0.1 or the corresponding ESR release stated above, unless a newer release is already available.
  2. Tax and GST filers: continue to use an active, unexpired and unrevoked DSC. Do not share the token or PIN. Download emSigner, emBridge or any DSC utility only from the relevant government portal or the verified provider website.
  3. If a browser shows a certificate warning: stop. Do not use an “advanced” option to continue to the site, even if the page resembles the Income Tax, GST, banking or eMudhra website.
  4. Website operators: check whether any server certificate chains to one of the six named TLS intermediates. If it does, contact the certificate provider and replace it; revocation can otherwise cause browser errors.
  5. Software publishers: check whether released software was signed through either affected “EM OV CS CA - G3B” or “EM OV CS CA - G3C” intermediary, then follow the platform and certificate-provider remediation guidance.

When should a tax-filing DSC be replaced?

Replace or re-register a subscriber DSC when it has expired, is revoked, is lost, or when its token or PIN may have been compromised. The Income Tax Department’s DSC tutorial says a DSC registered on the portal must be active, unexpired and not revoked. The current portal manual also lets a user view the registered certificate and register a new DSC.

If a filing deadline is close and the portal rejects the certificate, first view the certificate details and its status, update the official signing utility, and use the portal’s documented re-registration or grievance route. Do not buy a replacement merely because the same company name appears in this separate TLS and code-signing incident.

Reviewed on 21 October 2026 using the public incident record available that morning. This is a general security and compliance explanation. The investigation is continuing; follow later directions from eMudhra, the CCA and the relevant government portal if the published scope changes.

Official references