Security Advisory on the eMudhra Certificate Incident

Published on October 22, 2026 | Last updated on October 22, 2026

Hello,

This is a security advisory regarding a certificate authority (CA) incident involving eMudhra, a third-party CA. The incident was publicly disclosed on October 20, 2026. We are sharing this advisory to explain the issue and its relevance to Zoho Sign.

Summary: Based on our analysis, documents signed with Zoho Sign are not affected.

What happened: On October 17, 2026, an independent researcher reported to the browser and OS root programs that the private keys of eight eMudhra intermediate CA certificates could be recovered easily because of flawed key generation at the CA. Six of these certificates are TLS (website) intermediates and two are code-signing intermediates.

Details of the incident are available in Mozilla's public report.

Relevance to Zoho Sign: Zoho Sign's document-signing certificates are issued by GlobalSign (US, AU, JP, CA, UAE, and SA data centers), QuoVadis (EU data center), Netrust (SG data center) and eMudhra (India data center, Sub CA for Class 3 Document Signer 2022), as listed on our security page. The compromised certificates belong to eMudhra's emSign public web PKI (its browser-trusted TLS and code-signing roots). Zoho Sign's India signer is eMudhra's CCA-licensed digital signature hierarchy, rooted at the Root Certifying Authority of India (RCAI) under the Controller of Certifying Authorities, a separate trust chain that is not part of this incident.

Severity: Informational

Impact: Documents signed with Zoho Sign are not affected. The signing certificates in the US, EU, AU, JP , CA, UAE, SA, and SG data centers come from GlobalSign, QuoVadis, and Netrust which are not part of this incident.

Actions taken and current status:

Date	Status
October 17, 2026	Incident reported to the root programs. Firefox and Chrome blocked the affected certificates the same day.
October 18, 2026	eMudhra revoked all eight certificates.
October 19–20, 2026	Apple and Microsoft blocked the affected certificates.
October 21, 2026	As per eMudhra's statement on recent certificate security incident, "There is no impact whatsoever on our digital signature and eSign services, in India or anywhere else in the world"

Recommended actions: No action is required for documents signed with Zoho Sign.

We are monitoring eMudhra's investigation and will update this advisory if there are any relevant changes.
We understand this incident may raise concern for our users. If you have any questions, please write to support@zohosign.com.

Regards,
Zoho Sign