# eMudhra intermediate CA compromise triggers cross-platform certificate blocks

> **Key takeaway:** Mozilla blocked eight compromised eMudhra intermediate CA certificates after private key exposure that could enable fraudulent HTTPS certificate issuance.

**Published:** 2026-10-20T14:56:23+00:00 
**Source:** Linux Weekly News (LWN.net) 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/emudhra-intermediate-ca-compromise-triggers-cross-platform-c.html 

## Summary
Private keys for eight eMudhra intermediate certificates have been compromised, allowing potential attackers to issue fraudulent TLS certificates for arbitrary domains. Mozilla has blocked the certificates via OneCRL and updated NSS to 3.131.1. Chrome, Apple, and Microsoft have also deployed blocks between October 17 and 20. NetBSD has published manual blocking instructions for its users.

## Affected certificates and vendor response timeline
- Eight eMudhra intermediate CA certificates had their private keys compromised
- Attackers with these keys could issue valid-appearing TLS certificates for any domain
- Mozilla blocked certificates via OneCRL and released NSS 3.131.1 with updated trust store
- Chrome blocked: October 17; Apple devices: October 19; Microsoft: October 20
- NetBSD Foundation issued manual instructions to block the certificates on NetBSD systems
- A public tracking site monitors which browsers and clients still trust the compromised certificates

## Why it matters
The incident highlights continued fragility in the Web PKI trust model where intermediate CA compromises can enable global traffic interception. Cross-vendor coordination through OneCRL and platform-specific blocking mechanisms limited exposure, but users of less mainstream browsers and operating systems may remain vulnerable without manual intervention.