eMudhra keys compromised, triggering browser and Go blocks
Mozilla and Google's Chrome Root Program confirmed on October 20 that eight eMudhra intermediate certificate authority (CA) keys were compromised; Chrome, Firefox and Go security releases blocked them.
Anyone holding an intermediate key can mint a certificate for any website. The Chrome Root Program said no certificates chaining to the six web-facing intermediates appeared in Certificate Transparency (CT) logs before Chrome's block, leaving no logged rogue certificates for CT-requiring browsers to trust. Go took a different route, hard-coding hashes for all eight keys because Linux trust stores cannot reliably revoke them.
For teams using Go to verify software, two of the eight were code-signing intermediates, so the incident reaches software trust as well as websites. The CT finding narrows evidence of website-certificate abuse, but does not explain how eMudhra lost the keys or whether others hold them; ecosystem blocks do not resolve that uncertainty.
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.