Compromised CA & Revocation Checker
Test whether your browser or client trust store blocks compromised intermediate CAs (such as the October 2026 eMudhra incident) and revoked certificates.
Frequently Asked Questions
What was the eMudhra intermediate CA compromise?
In October 2026, security researchers disclosed that eight intermediate CA certificates operated by eMudhra (emSign) had catastrophically weak elliptic-curve private keys generated with near-zero entropy (one private key was literally the number 4). This allowed anyone to compute the signing keys in seconds and forge trusted TLS certificates for any domain.
How does this tool test if my browser is impacted?
The tool instructs your browser to establish HTTPS connections directly to live test endpoints hosted with certificates signed by the compromised intermediate CAs. If your browser connects successfully, your trust store is at risk. If the connection fails with a certificate validation error, your browser has received the revocation push (via CRLSets, OneCRL, or OS updates) and is protected.
Why does this test have to run directly in the browser?
A server or proxy cannot test your browser because the TLS handshake must terminate directly in your client. If a server-side proxy or worker fetched the endpoint, it would only test the server's trust store, not your browser's local certificate store.
What should I do if my browser shows "At Risk"?
Restart or update your browser immediately. Major browser vendors (Google Chrome, Firefox, Apple, Microsoft) pushed automatic blocklists within hours of disclosure, but browsers often require a restart or internet check to download updated CRLSets or OneCRL databases.
Can I test command-line tools like curl or Python?
Yes! Use the CLI & Terminal tab to copy one-line commands for curl, PowerShell, or Python. These tests determine whether your operating system or local developer CA bundle has been patched.