Network · 3h ago

eMudhra keys compromised, triggering browser and Go blocks

Mozilla and Google's Chrome Root Program confirmed on October 20 that eight eMudhra intermediate certificate authority (CA) keys were compromised; Chrome, Firefox and Go security releases blocked them.

Anyone holding an intermediate key can mint a certificate for any website. The Chrome Root Program said no certificates chaining to the six web-facing intermediates appeared in Certificate Transparency (CT) logs before Chrome's block, leaving no logged rogue certificates for CT-requiring browsers to trust. Go took a different route, hard-coding hashes for all eight keys because Linux trust stores cannot reliably revoke them.

For teams using Go to verify software, two of the eight were code-signing intermediates, so the incident reaches software trust as well as websites. The CT finding narrows evidence of website-certificate abuse, but does not explain how eMudhra lost the keys or whether others hold them; ecosystem blocks do not resolve that uncertainty.

Timeline

• Oct 20 Reported by Dark Reading

Sources

2 sources covering this story

• Dark Reading Oct 20

  Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys

  Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian certificate authority (CA).

• The Hacker News Oct 20

  Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

  Eight eMudhra CA keys were compromised, prompting browser blocks and software fixes.

Part of the PlainSec briefing for 2026-10-20

Editions

• Briefing for 2026-10-20