November 02, 2026
Who should read this bulletin:
Customers using Signhost.
Summary
In October 2026, a security issue was disclosed affecting certificates issued by eMudhra, a public certificate authority. The issue could, under specific circumstances, allow an attacker to impersonate a trusted online service.
This is an industry-wide issue and is not specific to Signhost and Entrust. Major web
browsers, Windows and Apple operating systems have already been updated to block the affected certificates.
Signhost used a standard Microsoft .NET trust store that included one of the affected certificates. Entrust has taken corrective action to ensure that Signhost no longer trusts the affected certificates. The update has already been deployed, and no customer action is required regarding Signhost.
As an additional precaution, customers should ensure that their browsers and operating systems are up to date. Customers who connect to Signhost through the API should also keep the operating system or runtime environment used by their integration up to date.
Impact of Vulnerability
Signhost securely connects to a number of external services, for example identity
verification, email and SMS providers, payment providers and customer-configured
webhooks.
Before the update, an attacker who was able to present an affected certificate and intercept or redirect network traffic could have impersonated one of these external services. This could have exposed or altered information exchanged with that service, including documents or signer information.
There are no known cases of this vulnerability being exploited against Entrust customers.
Connections between users' browsers and Signhost are checked by the browser. Major browsers have already blocked the affected certificates.
Mitigating Factors
Entrust has already updated all Signhost services. Customers do not need to take any action on the Signhost service.
Major web browsers and the Windows and Apple operating systems have already blocked the affected certificates. Users who keep their browsers and operating systems up to date are protected when accessing Signhost.
To impersonate a server, an attacker must also be able to intercept or redirect network traffic between Signhost and that server.
Corrective Action
No customer action is required on the Signhost service. Entrust has applied the following
corrective actions to the Signhost hosted service:
1. Updated all Signhost services so that the affected root certificates are no longer
trusted.
2. Deployed the updated services to the hosted service.
To ensure full protection, customers and their users should:
1. Apply all available updates for their web browsers and operating systems.
2. Restart the browser, or the device if required, so that the updates take effect.
3. If they integrate with the Signhost API, make sure that the trust store used by their
integration (operating system, Java, .NET, Node.js or similar) is updated by its vendor.
Support
Entrust Support can be contacted using our standard methods:
Email: support@signhost.com
Support Portal: http://portal.signhost.com/
Phone: support numbers
© Copyright 2026 Entrust Corporation. All rights reserved.
Entrust is a trademark or a registered trademark of Entrust, Inc. in the United States and certain countries. All Entrust product names and logos are trademarks or registered trademarks of Entrust, Inc. or Entrust Corporation. All other company and product names and logos are trademarks or registered trademarks of their respective owners in certain countries.
The information in this bulletin is proprietary and confidential to Entrust Corporation. and its subsidiaries, and any disclosure of this information is governed by the confidentiality terms in the agreement pursuant to which you obtained a license for the referred to Entrust products.
The information in this bulletin is provided "as is" by Entrust without any representations, conditions and/or warranties of any kind, whether express, implied, statutory, by usage of trade, or otherwise. Entrust specifically disclaims any and all representations, conditions, and/or warranties of merchantability, satisfactory quality, and/or fitness for a particular purpose. To the maximum extent permitted by applicable law, in no event will Entrust be liable for any damages, losses or costs arising from your or any third party actions or omissions in connection with this bulletin. The only representations, conditions and/or warranties that may be applicable to any Entrust products that you may have are those contained in the agreement pursuant to which you obtained a license for those Entrust products.