Okta and Auth0 are removing trust in the eMudhra emSign ECC Root CA – G3
What happened?
On October 17, 2026, a researcher reported that the private keys of eight intermediate eMudhra certificate authorities were generated with insufficient entropy and could be derived from their public certificates. The derived private keys can be used to issue certificates for any domain, and software that trusts the eMudhra root will accept them.
Mozilla, Google, Apple, and Cloudflare have blocked the affected intermediates. Mozilla has removed the emSign ECC Root CA – G3 from its trust store, and Chrome will remove it on October 27, 2026. eMudhra has revoked the intermediates.
Okta’s response
Okta and Auth0 are removing trust in emSign ECC Root CA – G3 and the eight affected intermediates across our services.
Security Patching Services: The change is now rolling out across the production environments of both Okta and Auth0.
No Evidence of Exploitation: To date, Okta and Auth0 have observed no evidence of exploitation.
Do I need to do anything?
Only if Okta or Auth0 connects to a server you control and that server's certificate chain includes the eMudhra emSign ECC Root CA – G3. Inbound access to Okta and Auth0, including sign-in, is not affected.
The case to check is a non-browser connection or webhook that calls your own API, such as an Okta Inline Hook or Event Hook, or Auth0 Action, Custom Database connection, or Auth0 Federated Connection.
These connections may not have shown you any error before now. Run
openssl s_client -showcerts -connect <your-host>:443References