Browser warnings appear when the compromised eMudhra intermediates are still trusted.
eMUDHRA INTERMEDIATE CA KEYS COMPROMISED, BROWSER ROOTS REVOKE
*Eight eMudhra intermediate CA private keys were exposed. Major browsers and OS vendors have blocked the certificates and issued revocations. Users must update now to stay protected.*
The eMudhra certificate authority suffered a critical breach on 17 October 2026 when eight of its intermediate CA private keys were shown to be compromised. Researcher Wayne demonstrated the breach by signing a message with each key and publishing the proof, confirming that the keys could be recovered from certificates generated in April 2025. The intermediates sit beneath roots trusted by the major browser and OS ecosystems, meaning any holder of a private key could impersonate any website or service. In response, Mozilla, Microsoft, Apple and Chrome have blocked the certificates and pushed revocation data through their respective distribution mechanisms. The CA has also revoked the intermediates, but many non‑browser clients still rely on outdated trust stores and must be updated manually.
What happened to the eMudhra intermediate certificates?
On 17 October 2026, researcher Wayne proved that the private keys of eight eMudhra intermediate CAs were compromised by signing a message with each key and publishing the proof. The intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, as well as many downstream trust stores. The keys were incorrectly generated when the certificates were created in April 2025, allowing anyone to recover them from the certificates. No entries for these intermediates appear in Certificate Transparency logs for that period, meaning CT‑enforcing browsers could not have been attacked, but non‑CT clients remain vulnerable.
How have browsers and platforms responded?
Firefox and Chrome blocked the compromised intermediates on 17 October. Apple devices followed on 19 October, and Microsoft platforms on 20 October. The root programs and downstream trust stores received a responsible disclosure on 19 October and have either released updates or are preparing them. Revocation information was pushed through OneCRL, CRLite and CRLSets, and the CA itself revoked the eight certificates. Clients that do not consume revocation data still need software updates to drop trust in the intermediates.
Which software packages have been patched?
Linux distributions and language runtimes have shipped updates: Ubuntu ca‑certificates 20260816ubuntu0.22.04.1 (and later releases), Debian 20250419~deb12u2 (and later), Arch Linux ca‑certificates‑mozilla 3.131.1‑1, Gentoo 20260816.3.125, Fedora 2026.2.92_v9.0.319, FreeBSD ca_root_nss pending, Chainguard 20260909‑r3, Alpine 20261020‑r0, NSS 3.131.1, curl CA bundle 2026‑10‑20, Cloudflare CFSSL 2026.10.1, Homebrew 2026‑09‑25_1, Go 1.27.3 (and 1.26.10), Node.js 22.23.4 (and 24.22.1, 26.12.1), Python certifi 2026.10.19, pip 26.2.2, uv 0.13.4, Rust rustls‑webpki 0.103.16, webpki‑roots 1.0.10, Electron 44.9.1 (and earlier), Bun pending, Composer ca‑bundle 1.4.16 (and 1.6.0), Elixir castore 1.0.22, Perl Mozilla::CA 20261020. All users should install the latest versions.
What can macOS users do right now?
macOS blocks the compromised intermediates, but built‑in tools (curl, git, python3, perl, ruby, openssl) verify certificates against /etc/ssl/cert.pem without checking revocation, and that file has not been updated. Users can remove the affected roots by copying the file, filtering out the compromised entries with an awk command, and overwriting the original. Built‑in pip3 and virtual‑environment pip copies use an outdated root bundle; adding a sitecustomize.py that forces PIP_CERT to point at the cleaned /etc/ssl/cert.pem restores proper verification.
Frequently asked questions
When were the eMudhra intermediate certificates blocked by major browsers?
Firefox and Chrome blocked them on 17 October, Apple devices on 19 October, and Microsoft platforms on 20 October.
What is the cause of the eMudhra key compromise?
The private keys were incorrectly generated, allowing anyone to recover them from the certificates created in April 2025.
How can macOS users remove the compromised roots from their system trust store?
Copy /etc/ssl/cert.pem, filter out the compromised entries with an awk command, and overwrite the original file; then adjust pip to use the cleaned file via sitecustomize.py.
The eMudhra incident underscores the fragility of the global trust infrastructure when a CA missteps in key generation. While browsers have acted swiftly, the lingering exposure in legacy clients and tooling means the threat surface remains until every affected system updates its trust store. Users and operators must verify that their software reflects the latest revocations; otherwise the compromised intermediates will continue to be trusted, keeping the door open for malicious impersonation.
Sources: Hacker News (eMudhra intermediate CA compromise)