eMudhra intermediate CA compromise triggers cross-platform certificate blocks
Mozilla blocked eight compromised eMudhra intermediate CA certificates after private key exposure that could enable fraudulent HTTPS certificate issuance.
Summary
Private keys for eight eMudhra intermediate certificates have been compromised, allowing potential attackers to issue fraudulent TLS certificates for arbitrary domains. Mozilla has blocked the certificates via OneCRL and updated NSS to 3.131.1. Chrome, Apple, and Microsoft have also deployed blocks between October 17 and 20. NetBSD has published manual blocking instructions for its users.
Affected certificates and vendor response timeline
- Eight eMudhra intermediate CA certificates had their private keys compromised
- Attackers with these keys could issue valid-appearing TLS certificates for any domain
- Mozilla blocked certificates via OneCRL and released NSS 3.131.1 with updated trust store
- Chrome blocked: October 17; Apple devices: October 19; Microsoft: October 20
- NetBSD Foundation issued manual instructions to block the certificates on NetBSD systems
- A public tracking site monitors which browsers and clients still trust the compromised certificates
Why it matters
The incident highlights continued fragility in the Web PKI trust model where intermediate CA compromises can enable global traffic interception. Cross-vendor coordination through OneCRL and platform-specific blocking mechanisms limited exposure, but users of less mainstream browsers and operating systems may remain vulnerable without manual intervention.
What to do
- Update to NSS 3.131.1 if you use Mozilla software or rely on its trust store.
- NetBSD users should follow the NetBSD Foundation's manual instructions to block the certificates.
- Users of other browsers and operating systems should check for updates or guidance to disable the compromised certificates.
- Visit the public tracking site to verify whether your browser or client still trusts the compromised certificates.
Original reference: lwn.net →