EMudhra Intermediate CA Compromise

Eight eMudhra intermediate CA private keys have been compromised; those intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. The compromise was demonstrated when the reporter Wayne signed a fixed message with each affected intermediate key and published proof.zip containing the message, each intermediate certificate, its public key and a signature (verifiable with OpenSSL). Root programs blocked the affected certificates in Firefox and Chrome on October 17, in Apple devices on October 19 and in Microsoft products on October 20, and the issuing CA revoked the intermediates. Downstream trust stores were notified on October 19 and many vendors have issued or are preparing updates.

Possession of any compromised intermediate private key enables an attacker to impersonate any website or service, so major vendors distributed revocation information (OneCRL, CRLite, CRLSets) to protect users, but many clients do not consume those feeds and require software updates. Users should update browsers and operating systems immediately. Developer and packaging fixes listed include Go 1.27.3/1.26.10, Electron 44.9.1/43.8.1/42.11.16, certifi 2026.10.19, webpki-roots 1.0.10, Homebrew ca-certificates 2026-09-25_1 and NSS 3.131.1; Node.js and Composer updates are pending. Expert Linux users can follow provided distro-specific commands to distrust the affected roots. Fingerprints, SPKI hashes, serial numbers and CCADB IDs are published in affected-certificates.json. Site published by Dennis Jackson; source on GitHub.