GoKawiilPrivate keys of eight eMudhra intermediate CA certificates found compromised
A researcher known as Wayne demonstrated that private keys for eight eMudhra intermediate CA certificates had been compromised, by signing a message with each key and submitting proof to root program teams on October 17. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, and eMudhra has since revoked the affected certificates.
GoKawiil's interpretation of the reporting above, not reported fact.
Possession of these keys could let an attacker forge valid certificates to impersonate any website, undermining HTTPS trust for users of affected browsers and devices. Major browser vendors have pushed revocation data to protect their users quickly, but the disclosure notes that many other software clients don't check revocation lists and will remain vulnerable until they receive manual updates.
- Eight eMudhra intermediate CA private keys were proven compromised via signed verification messages.
- Firefox and Chrome blocked the certificates on October 17, Apple on October 19, and Microsoft on October 20.
- Clients that don't consume revocation data (OneCRL, CRLite, CRLSets) may still trust the compromised certificates until updated.
Source: emudhra.we-have-a-problem.com, 2026-10-20
Published there as: “EMudhra Intermediate CA Compromise”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.