Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

Private keys for eight eMudhra intermediate certificate authority certificates were compromised due to low randomness during an April 2025 ceremony, prompting emergency revocations and patches across major browsers, programming languages, and operating systems in October 2026.

Incident Overview and Cause

Mozilla and Google's Chrome Root Program confirmed the compromise on October 20, 2026, after a researcher reported the issue on the evening of October 17. According to Google and eMudhra, the keys were not stolen via an infrastructure breach; instead, a flaw in a key wrap and unwrap step during an April 30, 2025, generation ceremony produced a weak second set of keys alongside the intended ones. Security researchers demonstrated that the weak private keys could be easily computed from the public certificates in seconds.

Browser and Software Responses

Major browsers and software ecosystems moved quickly to mitigate the risk:

• Chrome and Firefox: Applied automated revocation lists (CRLSets and OneCRL) within hours of receiving the report on October 17.
• Operating Systems & Packages: Debian, Ubuntu, Canonical, Red Hat, and various Linux distributions released or prepared updates dropping affected root certificates, such as `emSign ECC Root CA - G3` and Sectigo's `AAA Certificate Services` root.
• Go Language: Released urgent security updates containing the eight compromised key hashes in its standard library to block untrusted chains.
• Node.js and Cloudflare: Issued updates and patched client software to protect ecosystems relying on static certificate bundles.

Practical Implications and Verification

While automated browsers handled the updates seamlessly, many applications relying on static certificate bundles (such as Python's certifi, curl, or custom containers) do not check revocation lists. Consequently, removing affected roots can break legitimate websites chaining to those roots until administrators transition to alternative hierarchies. Administrators and developers should verify whether their software environments utilize updated trust bundles, check vendor advisories from CERT-In or Red Hat, and monitor official eMudhra and browser security channels for ongoing remediation steps.