# eMudhra Intermediate CA Compromise

> Eight eMudhra intermediate CA certificates compromised, affecting millions of devices.
- Title: eMudhra Intermediate CA Compromise · We Have A Problem
- Summary: Eight eMudhra intermediate CA certificates compromised, affecting millions of devices. Attackers could impersonate any website using compromised eMudhra…
- Keywords: emudhra, intermediate ca, certificate compromise, root programs, certificate transparency, mozilla, microsoft, apple, chrome, certificate chains, security breach, trust stores
- Source: We Have A Problem — https://emudhra.we-have-a-problem.com
- Read time: 2 min
- Topics: emudhra, intermediate ca, certificate compromise, root programs, certificate transparency, mozilla, microsoft, apple, chrome, certificate chains, security breach, trust stores
## Compromised Certificates
Eight eMudhra intermediate CA certificates have been compromised, chaining to roots trusted by Mozilla, Microsoft, Apple, and Chrome.

> We have a problem here - Wayne
## How We Know
Wayne signed messages with the private keys of each compromised intermediate CA and reported them to Root Program Teams on October 17, 2026.
## Immediate Actions
Root programs blocked the certificates in Firefox and Chrome since October 17, Microsoft since October 20, and Apple since October 22, 2026.
## Consequence
Attackers could impersonate any website or service using the compromised intermediate CA certificates.
## Remediation
Mozilla, Microsoft, Apple, and Chrome have remediated the issue through revocation tools like OneCRL, CRLite, and CRLSets.
## Compromised Intermediates
The eight compromised intermediates chain to roots including emSign ECC Root CA - G3 and AAA Certificate Services.
## Clients at Risk
Electron apps like Slack and Discord require updates to stop trusting the compromised intermediates.
## Certificate Transparency
Two chains marked No CT were added on October 22, 2026, meaning clients that enforce CT reject them even if they trust the intermediate.
## Client Patches
Operating systems, software, and applications have patched their trust stores to block the compromised intermediates.
## User Workarounds
Users can remove affected roots from their system trust stores to block the compromised intermediates.
## Root Cause
The private keys were incorrectly generated by the CA, allowing anyone to recover them from the certificates.
## Timeline
The issue was responsibly disclosed on October 19, 2026, with many trust stores releasing updates by October 22.
## Affected Systems
The compromised intermediates affect systems including macOS, Linux, Windows, Android, and NetBSD.
## Patch Details
Distributions like Debian, Ubuntu, and Fedora have updated their ca-certificates packages to block the compromised intermediates.
## Next Steps
Users should update their browsers and operating systems to the latest versions to prevent further compromise.
## Key takeaway

Attackers could impersonate any website using compromised eMudhra intermediate CA certificates.