Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

Key Points:

• The private keys of eight intermediate certificates from Indian CA eMudhra have been compromised, allowing potential issuance of trusted certificates for any website, confirmed by Mozilla and Google's Chrome Root Program on October 20.
• The compromise was reported by a researcher on October 17, with Chrome and Firefox blocking the certificates within hours; no trusted TLS certificates using these intermediates were logged in Certificate Transparency before the block.
• The affected certificates include six TLS (domain validated, organization validated, extended validation) and two code-signing intermediates, all chained to roots trusted by major browsers, with cross-signed copies by Sectigo also impacted.
• Major browsers and trust stores, including Chrome, Firefox, Apple, Microsoft, and Go, have revoked or blocked these certificates through updates, with some software removing the affected roots entirely to prevent further trust.
• The root cause and timeline of the key compromise remain unknown; Mozilla and other root programs are investigating, while users and administrators are advised to rely on revocation checks and update trust stores promptly to mitigate risk.