eMudhra Certificate Authority Compromise

Summary#

On 17 October 2026 it was disclosed that eight intermediate certificate authorities operated by eMudhra had been issued with weak private keys. Anyone recovering those keys could create TLS certificates that appear valid for any website, and two of the intermediates could sign Windows software.

This is an industry-wide issue in a third-party certificate authority. It is not a vulnerability in Halo software, and Halo does not use eMudhra certificates.

Browser, operating system and platform vendors blocked the affected certificates between 17 and 20 October 2026, and eMudhra has revoked them.

Impact on Halo#

Halo-hosted (cloud) customers: no action required.

We have reviewed the Halo cloud platform and confirmed that the affected certificates are blocked on all of our application servers.

Users' web browsers already reject the affected certificates, so connections from users to Halo were protected throughout.

Self-hosted (on-premise) customers: action required.

Halo uses the certificate trust store of the server it runs on. Self-hosted installations are protected once that server has received its operating system's update.

Action required for self-hosted customers#

Windows servers#

Microsoft blocked the affected certificates on 20 October 2026 through the Windows automatic root certificate update. Most servers will already have received this, but users should double check this.

For more information, read through Microsoft's response to the compromised eMudhra certificates

References#

• Google Security Blog: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
• Cloudflare: 8 eMudhra certificates are compromised

Contact#

For questions about this bulletin, contact security@usehalo.com