Compromised EMudhra Intermediate Certificates

Private keys for eight eMudhra subordinate CA certificates were reported compromised on October 17, 2026. Mozilla blocked the affected intermediates in Firefox via OneCRL within hours (22:59 UTC) to prevent fraudulent HTTPS certificates from being trusted, and on October 20 removed the upstream root that signed those intermediates from NSS to protect other trust-store consumers. That NSS change may make some servers unavailable to clients that don’t get OneCRL protections until those servers rechain. Mozilla published lists of impacted intermediates and roots and advised trust‑store operators to either rely on revocation checks, push immediate intermediate‑blocking updates, or consider removing the implicated roots; contact for coordination is [email protected]. Mozilla stated it currently believes other CAs are not affected.

The Chrome Root Program corroborated the compromise and on October 17 (report at 18:05 UTC; CRLSet landed at 19:45 UTC) pushed a CRLSet blocking the SPKI hashes of the six TLS‑issuing compromised intermediates (two other compromised intermediates were code‑signing CAs and did not require blocking). Chrome’s enforcement of Certificate Transparency meant no logged TLS certificates chaining to these intermediates existed before the block, preventing fraudulent trust. Chrome will also remove the upstream eMudhra root in an upcoming Root Store update (v43) and is conducting a formal evaluation of eMudhra’s remaining CA assets.