Home / Technology / Digital Trust Shattered: 8 eMudhra Keys Exposed
Digital Trust Shattered: 8 eMudhra Keys Exposed
21 Oct
Summary
- Eight eMudhra intermediate CA private keys were compromised.
- Major browsers and operating systems have blocked the compromised keys.
- No forged certificates have been detected thus far.
Eight intermediate private keys belonging to India's eMudhra certificate authority were compromised, prompting swift action from major tech companies. On October 17, 2026, a researcher reported the breach to Mozilla and Google, who confirmed the compromise by October 20. Browsers like Chrome and Firefox immediately blocked the compromised keys, which could have allowed attackers to forge HTTPS certificates for any website.
While eMudhra has revoked all eight affected certificates, the incident highlights the critical role of certificate authorities in securing online communications. The compromise occurred between April 2025, when the intermediates were generated, and October 17, 2026, when it was reported. The exact method of exposure remains unconfirmed, with reports suggesting either theft or weak key generation practices.
Users on systems that do not automatically check for certificate revocation are most at risk. However, major platforms such as Firefox, Chrome, Apple, and Microsoft have already implemented blocks. While no forged certificates have been identified, organizations are urged to audit their environments and ensure all systems are updated to mitigate potential risks.
