# Browsers block eight eMudhra intermediate CAs after their private keys leak

Source: https://startwithidentity.com/blog/2026-10-20-browsers-block-eight-emudhra-intermediate-cas-after-private-keys-leak/
Last updated: 2026-10-20
License: content by Start with Identity. Cite the source URL.

---

Mozilla said on October 20 that the private keys of eight intermediate certificate authorities run by eMudhra, the Indian CA that sells under the emSign brand, had been compromised. A researcher reported it on Saturday, October 17; Chrome blocked the six TLS intermediates through CRLSet at 19:45 UTC and Mozilla pushed a OneCRL block to Firefox by 22:59 UTC. The other two are code-signing CAs. Apple blocked the certificates on October 19 and Microsoft on October 20, according to The Hacker News. Mozilla's NSS 3.131.1 removes the emSign ECC Root CA - G3 that issued the TLS intermediates, Go 1.27.3 and 1.26.10 reject chains containing any of the eight keys, and the intermediates also exist as [Sectigo](https://startwithidentity.com/vendors/pki/sectigo/) cross-signed copies. How the keys left eMudhra has not been disclosed.

## Why it matters

A CA key is an identity factory: whoever holds it can mint a certificate that proves to a client it is talking to any domain, or that code came from any publisher. Chrome found no TLS certificate from these intermediates in Certificate Transparency logs, so browsers that require CT were not exposed. Most other software is less protected.

Go binaries and anything built on Python's certifi bundle do not check revocation, so they keep trusting these chains until rebuilt or until their root bundle updates. Rebuild Go services on the fixed releases, update certifi (2026.10.19), Rust webpki-roots and OS trust stores, and inventory where your own [PKI](https://startwithidentity.com/glossary/pki/) clients pin or bundle roots. If you buy certificates from eMudhra, plan to move chains now, since root removal also breaks legitimate certificates. Teams that already automate [certificate lifecycle](https://startwithidentity.com/glossary/certificate-lifecycle/) work can swap issuers in days rather than weeks.

Source: [Mozilla Security Blog](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/)