eMudhra is a certificate authority whose certificates were trusted by major browsers and operating systems. Certificate authorities play an important role in HTTPS: they help browsers verify that a website is really the site it claims to be.
On October 17, 2026, a security researcher reported that the private keys of eight eMudhra intermediate certificates were compromised. The keys had been generated with extremely weak randomness, so they could be recovered from the public certificates in under a second. Someone who obtained these keys could use them to issue fraudulent certificates and impersonate websites that browsers would otherwise trust. As of publication, there have been no public reports of these keys being exploited in attacks.
Browser vendors acted quickly. Google and Mozilla revoked trust in the affected certificates within hours of the report, followed by Apple and Microsoft. The root cause was a flaw in eMudhra’s key generation process.
AdGuard was not involved, but the incident required us to adjust how AdGuard handles HTTPS traffic.
When HTTPS filtering is enabled, AdGuard checks server certificates itself so it can inspect encrypted traffic and block ads and trackers. We need to make these checks at least as strict as those performed by browsers, and, when necessary, take a more conservative approach.
