Eight eMudhra Intermediate CA Keys Compromised, Browsers Block Certificates

· Cybersecurity · India

Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate certificate authority certificates are compromised, prompting an emergency response from browsers and software projects. An intermediate CA signs the certificates websites present, so anyone holding one of these keys could issue a certificate for any site a browser would trust. Google, Mozilla, Apple and the Go project moved to block chains passing through the affected keys; Go released versions 1.27.3 and 1.26.10 the same day, whose certificate verifier rejects any chain involving them, breaking connections to sites issued under those keys. How the keys were compromised remains unclear. eMudhra is an Indian certificate authority.

Why it matters：The compromise of an intermediate CA undermines the trust model the entire web depends on, and the rapid multi-vendor blocking shows how quickly a single CA failure can cascade into connection failures for ordinary sites worldwide.

Key points

  • Chrome Root Program and Mozilla confirmed the compromise on October 20
  • Go 1.27.3 and 1.26.10 reject certificate chains through all eight keys
  • The cause of the key compromise has not been disclosed

Sources (original reporting)

More stories from this day