eMudhra Intermediate CA Keys Compromised
Original: EMudhra Intermediate CA Compromise
Why This Matters
Compromised CA keys can enable silent MITM attacks on any HTTPS traffic.
Private keys for 8 eMudhra intermediate CA certificates were compromised and reported Oct 17, 2025. Mozilla, Chrome, Apple, and Microsoft have blocked them, but unpatched software remains at risk.
Researcher Wayne disclosed that the private keys of eight eMudhra intermediate CA certificates had been compromised, reporting the issue to root program teams on October 17. Proof was provided by signing a message with each of the eight private keys, verifiable via OpenSSL. The compromised intermediates chain to roots trusted by Mozilla, Microsoft, Apple, Chrome, and many downstream trust stores.
Mozilla and Chrome blocked the certificates starting October 17, Apple on October 19, and Microsoft on October 20. eMudhra also revoked the affected intermediates. For browsers and updated OS environments, tools like OneCRL, CRLite, and CRLSets distribute revocation data automatically.
The risk remains real for software that does not consume revocation information. An attacker holding these keys could impersonate any website or service. Patched versions are available for Ubuntu ca-certificates, Go (1.27.3/1.26.10), Electron, Python certifi, Rust webpki crates, NSS, and uv. Node.js and Composer patches are still pending. macOS users relying on the system curl face a specific gap: /etc/ssl/cert.pem is not updated by revocation mechanisms and requires a manual workaround.