eMudhra intermediate keys compromised, trust stores urged to act

Mozilla has warned maintainers of TLS trust stores that the private keys for eight eMudhra intermediate certificates were compromised, putting clients that do not reliably enforce revocation at risk of accepting forged certificates.

Dennis Jackson of Mozilla said the project learned of the breach on 17 October 2026. The intermediates are trusted under the Mozilla, Microsoft, Apple, and Chrome root programs and many downstream stores built on them. Six were issued for TLS use and two for code signing. eMudhra revoked the certificates on 18 October; Sectigo followed on 19 October.

Operators whose clients always fetch current revocation data and fail closed when it is missing need take no further steps. Everyone else should act. Where a store can distrust specific intermediates, that block should ship immediately. Firefox and Chrome users were already covered through OneCRL and CRLSets. Stores without intermediate-level controls should weigh removing trust in the roots that signed the affected chains, including paths through AAA Certificate Services and emSign Root TLS CA - G3.

The incident matters because intermediate keys sit high enough in the PKI hierarchy that a holder can mint certificates browsers and other software will treat as valid until revocation or distrust takes effect. Any lag between compromise and client-side blocking widens the window for man-in-the-middle attacks and malicious code signing.