Eight eMudhra CA keys compromised, triggering emergency fixes in browsers and Go

The private keys of eight intermediate certificate authority (CA) certificates operated by Indian CA eMudhra have been compromised, Mozilla and Google's Chrome Root Program confirmed on October 20, according to The Hacker News. Because intermediate CAs sign the certificates websites present, anyone holding these keys could in principle issue certificates for any domain that browsers would accept, which triggered a rapid wave of blocks and emergency updates across browsers, operating systems and programming ecosystems.

What happened

According to the timeline reported by The Hacker News, the Chrome Root Program received a report from a researcher on October 17 at 18:05 UTC. Chrome pushed a CRLSet update blocking the six TLS intermediates within two hours, and Mozilla finished distributing a OneCRL block to Firefox installations later the same evening. Apple blocked the certificates on October 19 and Microsoft followed on October 20, the same day Go shipped emergency security releases.

It is not known how the keys left eMudhra, when that happened, or whether anyone other than the reporting researcher holds them, the publication said. As of October 20, eMudhra had posted no public notice about the incident.

Technical details

eMudhra sells certificates under the emSign brand. The affected intermediates are EM DV TLS CA - G3B/G3C, EM OV TLS CA - G3B/G3C, EM EV TLS CA - G3B/G3C and the code-signing intermediates EM OV CS CA - G3B/G3C. The Hacker News reports that each also exists as a copy cross-signed by Sectigo's AAA Certificate Services root, although Chrome and Firefox stopped trusting that root for websites in April 2025.

Chrome said no TLS certificate chaining to the six intermediates had been logged to Certificate Transparency before its block, meaning none could have been trusted by default in browsers that require CT. Chrome added that it checked every other CA in its store and found no similar failures.

Go's fix, tracked as CVE-2026-111943 in Go 1.27.3 and 1.26.10, rejects any chain containing one of the eight keys by public-key hash, including cross-signed copies. There is no setting to disable it. Go maintainer Filippo Valsorda said Linux root stores are too poorly maintained for revocation to reach applications, so embedding the keys in code was the only option for now, according to the report.

Who is affected

Browser users generally need to do nothing, as revocation data arrives automatically. Firefox installations where Remote Settings is disabled by policy or blocked are covered by Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 (CVE-2026-113470). The bigger exposure is software that does not check revocation: Go programs, and tools relying on bundles such as Python's certifi, keep trusting a chain until their code or root bundle is updated. Fixes have shipped in NSS 3.131.1, certifi 2026.10.19 and Rust webpki-roots 1.0.10, while Node.js and Composer changes were still pending, The Hacker News said. Chrome plans to remove the emSign ECC Root CA - G3 from its root store.

What to do

• Rebuild Go services and tools with Go 1.27.3 or 1.26.10; versions 1.25 and older receive no fix.
• Update certifi, webpki-roots, NSS and other bundled root stores.
• Firefox fleets with Remote Settings disabled should deploy the October 20 releases.
• Operators of sites using emSign certificates should prepare to move to chains from other intermediates, since rebuilt clients will reject the blocked keys.