eMudhra Intermediate CA Private Key Compromise

In October 2026, it was disclosed that eight intermediate Certificate Authority (CA) private keys belonging to eMudhra were compromised. These certificates chain to major roots trusted by Microsoft, Apple, Google, and Mozilla. The compromise stems from an underlying flaw in how the private keys were originally generated in April 2025, theoretically allowing any party to recover the private keys from the certificates themselves.

While major browser vendors (Chrome, Firefox, Safari, Edge) have implemented blocks using mechanisms like CRLSets and OneCRL, the incident poses a significant threat to non-browser clients. Applications like Slack and Discord (Electron-based), command-line tools like curl, and various language runtimes (Python, Node.js, Go) often rely on static CA bundles or lack robust revocation checking, leaving them vulnerable to man-in-the-middle (MitM) attacks and service impersonation.

The business impact is high for organizations utilizing automated scripts, IoT devices, or legacy systems that do not enforce Certificate Transparency (CT). Because leaf certificates for some compromised chains were never logged to CT, attackers could potentially intercept traffic without being detected by monitoring tools that rely on CT log auditing.