eMudhra CA Keys Compromised; Browsers Block Them

The private keys behind eight intermediate certificates run by the certificate authority eMudhra have been compromised, Mozilla said on 20 October. In a Security Blog post, it said it received the report “On Saturday, October 17, at 20:06 UTC” (21:06 BST) and blocked the certificates in Firefox within hours.

The keys sit high in the chain of trust that tells browsers a website is genuine. “These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control,” Mozilla said. “An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.” No source reports that any fraudulent certificate has been issued or used.

In brief

Mozilla says private keys for eight eMudhra intermediate certificates were compromised and could be used to issue fraudulent HTTPS certificates.
Firefox, Chrome, Apple and Microsoft have blocked the certificates, according to a disclosure site; no source reports that fake certificates were issued or used.
The cause is unknown, eMudhra has made no statement, and users are advised to update their browsers and operating systems.

How the compromise came to light

The fullest public account comes from a disclosure site, emudhra.we-have-a-problem.com, which says it was published by Dennis Jackson. “The private keys of eight eMudhra intermediate CA certificates have been compromised,” it says. “They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.”

To prove the point, the original reporter, named only as Wayne, signed a short message with each of the eight keys and sent it to the browser makers’ root programmes on 17 October, according to the site. The message read: “We have a problem here – Wayne”. The site publishes the signatures so that anyone can check them.

According to certificate data on the site, six of the eight are TLS intermediates used for website certificates and two are code-signing intermediates. Each also has a cross-signed version that chains to Sectigo’s AAA Certificate Services root. The data shows eMudhra revoked its versions on 18 October, between 09:24 and 09:38 UTC (10:24 to 10:38 BST), giving the reason as CA compromise; the Sectigo cross-signs were revoked on 19 October at 10:35 UTC (11:35 BST).

Intermediate type	Number	Revoked by eMudhra (BST)
TLS (DV, OV and EV, G3B and G3C)	6	18 Oct, 10:24 to 10:38
Code signing (OV, G3B and G3C)	2	18 Oct, 10:33 to 10:35

Source: impacted-intermediates.json, published on emudhra.we-have-a-problem.com.

Browsers moved within hours

Mozilla says it blocked the certificates through OneCRL, its central list of revoked certificates, which works “without requiring users to update or restart Firefox.” “By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations,” it said. That was 23:59 BST on 17 October.

Other browser makers followed. “The certificates have been blocked in Firefox and Chrome since the 17th of October, in Apple devices since the 19th and in Microsoft since the 20th,” the disclosure site says. It adds that the issue was disclosed to downstream trust stores on 19 October.

Mozilla is also releasing Firefox 158.0.1 for desktop and Android, plus Firefox ESR 115.43.1 and ESR 153.5.1, for users whose custom settings blocked the OneCRL update. It is updating NSS, its security library, to version 3.131.1 to “remove the root certificate that signed the affected intermediates”, which protects other software that uses Mozilla’s trust store.

What users and developers should do

The practical advice is simple. “Users should update their browsers and operating systems to the latest versions as soon as possible,” the disclosure site says. The site warns that revocation alone is not enough, because many other clients ignore revocation data and need software updates to stop trusting the compromised intermediates.

Developers need to update too. The site lists patched releases for Go (1.27.3 and 1.26.10), Electron (44.9.1, 43.8.1 and 42.11.16), Python’s certifi (2026.10.19) and NSS (3.131.1), among others, with fixes for Node.js and Composer’s ca-bundle marked “pending”. It also gives Linux workarounds for expert users, but says this is “NOT recommended for ordinary users”.

How the keys were obtained is unknown. TSN found no statement on eMudhra’s websites, and Mozilla says only: “We will share more information as soon as circumstances allow.”

Our read

This is TSN’s analysis. The speed of the response is the reassuring part: the main browsers blocked the certificates within days, and Firefox within hours. The worry is the long tail of software that relies on bundled trust stores rather than live revocation lists, which stays exposed until it is updated. Until eMudhra explains how its keys were exposed, the question of how many other systems are affected stays open.