Progressive Solutions, Inc.Est. 1979

Security notice

PSI is not affected by the eMudhra CA compromise

Compromised eMudhra intermediate certificates · Published 21 October 2026 by Noah Moerbeek

Summary. PSI does not use eMudhra certificates. None of the certificates securing PSI websites and hosted portals chain to the compromised eMudhra intermediates. Agencies do not need to take any action for PSI systems.

What happened

On 17 October 2026 it was reported that the private keys for eight intermediate certificates operated by eMudhra, a certificate authority, could be recovered. A flaw in a 2025 key generation ceremony produced keys with too little randomness to be secure. Six of the intermediates could issue certificates for websites and two could sign software.

  • Why it matters. Anyone holding those keys could issue a certificate that impersonates a real website, making intercepted traffic look legitimate.
  • Browsers have responded. Mozilla, Google and Apple blocked the compromised intermediates between 17 and 19 October, and eMudhra revoked them on 18 October.
  • Remaining risk. Software that keeps its own list of trusted authorities, or does not check revocation, may continue to trust these intermediates until it is updated. This includes some scripting runtimes, appliances and older systems.

Why PSI is not affected

  • We do not use eMudhra. Certificates for PSI websites and hosted portals are issued by Sectigo, SSL.com, Let’s Encrypt and Amazon Trust Services.
  • Confirmed in public records. On 21 October 2026 we reviewed the public Certificate Transparency logs for progressivesolutions.com, progressivecloud.net and paragonlink.net. No certificate for any of these domains, current or expired, was issued by eMudhra.
  • Software we deliver. PSI does not sign its software with eMudhra code signing certificates.

What agencies should do

Nothing is required for PSI systems. If your agency hosts a PSI portal on its own domain, the certificate for that domain is managed by your agency; your IT team can confirm its issuer. Across your wider environment, we recommend keeping operating systems, browsers and security appliances updated so their trusted certificate lists include this week’s changes.

Questions

If your IT or security team needs a written statement for your records, email support@progressivesolutions.com or call 714-671-1597.

References: BleepingComputer · ctlogs.dev