Eight eMudhra Intermediate CAs Compromised

Eight eMudhra intermediate certificate authorities had their private keys compromised, affecting roots trusted by Mozilla, Microsoft, Apple, and Chrome as well as many downstream trust stores. A researcher proved the breach by signing messages with each of the eight private keys and reported the findings on October 17th. With access to these keys, an attacker could forge valid certificates for any domain.

Mozilla, Apple, and Chrome have blocked the compromised intermediates through their revocation mechanisms, protecting their user bases. The issuing CA has revoked the certificates. However, many client applications and trust stores lack automated revocation checking and require software updates to stop trusting the compromised intermediates. Users should update browsers and operating systems immediately, while administrators must verify their TLS clients properly reject these certificates and may need to apply platform-specific remediation to remove the affected roots.