GoKawiilGoogle, Mozilla, Apple, Go Block Certificates Tied to Compromised eMudhra CA Keys
Google, Mozilla, Apple, and the Go programming language project have blocked trust in certificates issued using eight compromised intermediate certificate authority keys belonging to Indian CA eMudhra. Six of the keys were used for TLS website certificates and two for code signing, raising the possibility that attackers could impersonate legitimate websites or software. Browser makers distributed the blocks automatically, while applications built with Go require developers to rebuild using patched versions 1.27.3 or 1.26.10.
GoKawiil's interpretation of the reporting above, not reported fact.
Compromised CA keys undermine the trust chain that secures web traffic and software signing, potentially letting attackers forge certificates that browsers and systems would otherwise accept as legitimate. Google noted its Certificate Transparency logs would have caught affected TLS certificates before the blocks, suggesting some protection was already in place, but it remains unclear whether attackers exploited the keys before detection. The incident also shows uneven protection across platforms, since Go-based applications need manual rebuilding rather than receiving automatic fixes like browsers.
- Eight compromised eMudhra CA keys led to coordinated certificate blocks by Google, Mozilla, Apple, and the Go project.
- Six keys affected TLS website certificates and two affected code-signing certificates.
- Go applications must be rebuilt with patched versions 1.27.3 or 1.26.10, unlike browsers that update protections automatically.
Source: darkreading.com — Jai Vijayan, 2026-10-20
Published there as: “Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.