Preventive Security Measures Regarding the eMudhra Certificate Authority Incident
Status: Preventive Review in Progress
Published: October 22, 2026
Last Updated: October 22, 2026
Event Overview
eMudhra/emSign recently disclosed a security issue involving the private keys of certain intermediate certificate authorities.
Under specific conditions where a client continues to trust the affected certificates and an attacker is able to intercept or redirect network communications, the issue could be used to forge website certificates, impersonate a target website, or read or modify network traffic.
Browser, operating system, and runtime vendors are responding by revoking the affected certificates and updating certificate trust stores.
Impact on Notta
Our review confirmed that the TLS certificate chains currently used by Notta’s external services do not contain the affected eMudhra/emSign certificates.
Notta’s business communications use TLS encryption. Because this event also involves certificate authority trust on clients and servers, Notta is conducting further validation of the certificate trust stores used by relevant applications, runtime environments, and third-party components.
As of the last update to this notice, Notta services are operating normally, and we have found no indication of service anomalies related to this event. The preventive security review remains in progress.
Impact on Customer Data and Accounts
Based on the certificate chain review completed to date, the certificates used by Notta’s external services are not among the affected certificates disclosed in this event.
As of the last update to this notice, there is no evidence that this event has affected Notta customer data or accounts. Further review of the certificate trust stores used by clients, servers, containers, and primary runtimes is still in progress.
Notta’s Response
Notta has completed or is carrying out the following measures:
Reviewed the certificates and complete certificate chains actually used by Notta’s external domains;
Reviewing the certificate validation mechanisms used by the web, desktop, and mobile applications;
Checking the certificate trust stores used by servers, container images, and primary runtimes;
Tracking security updates from operating system, browser, runtime, and other vendors, and applying and validating relevant updates when available;
Continuing to monitor certificate issuance records and security alerts for Notta domains.
These activities are preventive security measures and do not indicate that Notta’s server certificates or private keys have been compromised.
Actions Required by Customers
Customers do not currently need to change their Notta configuration or usage in response to this event and may continue using Notta services as normal. For browsers, operating systems, and other environments managed by customers, we recommend installing applicable security updates in accordance with the relevant vendors’ advisories.
If we subsequently determine that additional action is required for specific Notta client versions or usage environments, we will provide a timely update.
Further Updates and Support
Notta will update this notice when there is material progress in the review of client, server, container, and runtime trust stores. If our risk assessment or required customer actions change, we will provide an update promptly.
For further questions, please contact us through your usual Notta customer support or business contact channel.
Reference Information
Revision History
October 22, 2026: Initial publication. Review of Notta’s external certificate chains completed; inventories of client, server, container, and runtime trust stores and tracking of vendor updates remain in progress.
