The private keys of eight intermediate certificate authority (CA) certificates from eMudhra, an Indian CA that sells certificates under the emSign brand, have been compromised. The affected certificates include six TLS certificates (domain-validated, organization-validated, and extended-validation) and two code-signing certificates. Google, Mozilla, Apple, Microsoft, and the Go project moved quickly to block the certificates, though both Dark Reading and The Hacker News report that it remains unclear how the keys were compromised or whether anyone besides the researcher holds them.
According to The Hacker News, a researcher identified only as Wayne reported the compromise to browser root programs on the evening of October 17. Chrome and Firefox pushed revocation updates within hours, and eMudhra has revoked the eight certificates. The Chrome Root Program said no TLS certificate chaining to the six intermediates used for websites had been logged to Certificate Transparency before the block, so none could have been trusted by default in browsers that require CT logging. The researcher signed a message with each of the eight keys to prove the compromise.
Both sources agree that the response was swift and broad. Apple blocked the certificates on October 19, Microsoft on October 20, and other trust stores were notified. Software fixes include Go 1.27.3 and 1.26.10, Firefox 158.0.1 and ESR releases, NSS 3.131.1, Python certifi, Rust webpki-roots, and Homebrew ca-certificates; Node.js and Composer updates are pending. Mozilla said it does not believe the problem affects other CAs, and Chrome said it checked every other CA certificate in its store and found no other instances of this failure mode.