Overview
- A security researcher known as Wayne proved control of eight eMudhra intermediate private keys by signing a canonical message and reported the compromise on Saturday, October 17.
- Chrome and Firefox pushed targeted block lists within hours and eMudhra revoked the eight intermediates, with Apple and Microsoft applying blocks in the following days.
- Certificate Transparency searches found no TLS certificates chaining to the six website-capable intermediates before Chrome’s block, which greatly limited exposure for CT-enforcing clients.
- Many non-browser clients and language runtimes do not consume browser revocation feeds, so they remain vulnerable until maintainers ship updates or rebuilds; Go released urgent 1.27.3 and 1.26.10 updates that reject any chain containing the eight keys.
- The incident has prompted root-store changes (Chrome plans to remove emSign ECC Root CA - G3) and will force site operators to replace affected certificates and auditors to review CA key-generation and operational controls.