Emergency block: eight eMudhra CA keys compromised, Chrome, Firefox, Apple and Microsoft cut trust in certificates that could impersonate any website

Major browsers and operating systems have blocked eight intermediate certificate authority (CA) certificates belonging to eMudhra, an Indian certificate authority, after their private keys were shown to be compromised. According to the public incident page, an attacker holding one of these keys could impersonate any website or service.

What went wrong? #

The incident page, published by Mozilla's Dennis Jackson, says the keys were incorrectly generated, so anyone can recover them from the certificates themselves. The intermediates were created in April 2025.

A researcher who identified only as Wayne proved the problem by signing the message "We have a problem here - Wayne" with each of the eight private keys and sending the proof to browser root programs. Anyone can verify the signatures with OpenSSL.

Dark Reading reported that six of the intermediates were used for TLS (website) certificates and two for code signing.

Who has blocked the certificates? #

Mozilla blocked them through OneCRL and CRLite, and Google through CRLSets, so desktop browser users do not need to do anything. eMudhra has revoked the compromised intermediates, according to the incident page.

The Go team released Go 1.27.3 and 1.26.10 on 19 October with a fix in crypto/x509 that blocks a small set of intermediates from a specific CA, tracked as CVE-2026-111943. It "highly recommend[s] immediately upgrading."

Were fake certificates issued? #

That is not known. The incident page says no certificates from these intermediates appear in Certificate Transparency logs during the affected period, so browsers that enforce Certificate Transparency could not have been attacked. It says it is unknown whether the flawed keys were used against software outside the browser ecosystem that does not enforce Certificate Transparency.

What should organizations do? #

1. Rebuild and redeploy Go applications with Go 1.27.3 or 1.26.10.
2. Update operating systems, browsers, language runtimes and appliances as vendors ship trust store updates. The incident page warns that clients that do not check revocation need a software update to stop trusting these intermediates.
3. If you hold certificates issued by eMudhra under these intermediates, contact eMudhra about replacement, since revoked intermediates will break those certificates.
4. Review any custom or pinned trust stores in your own software and remove the affected intermediates.