A certificate authority (CA) is a company that browsers and operating systems trust to vouch for websites. In October 2026 one CA, eMudhra, had a key-generation mistake that affected eight intermediate certificates. This guide explains what happened, who is exposed, and what a website or app owner should update. It contains no attack detail.
What happened
According to Mozilla's incident report, on 17 October 2026 a researcher reported that the private keys of eight eMudhra intermediate certificates were compromised and supplied proof of key control. Mozilla recovered the private keys independently within hours, which confirmed that the key generation was flawed and trivial to exploit.
Six of the certificates are for TLS (website certificates) and are trusted by the Chrome, Mozilla, Microsoft and Apple root programs. The other two are for code signing and are trusted by Microsoft. eMudhra marked all eight as revoked on 18 October. BleepingComputer reports that eMudhra blamed a script error that generated a second, weaker set of keys in April 2025, and that eMudhra said most of the affected intermediates were never used in production and it found no evidence they were used to issue certificates to end users.
An attacker holding the private key of an intermediate CA could impersonate a website or service, so these keys must not be trusted.
Who is protected already
- Browsers: Firefox and Chrome have blocked the certificates since 17 October, Apple since 19 October and Microsoft since 20 October.
- Certificate Transparency: the incident tracker run by researchers notes there are no log entries for these intermediates since April 2025, so clients that enforce Certificate Transparency (Firefox, Chrome, Edge and Safari) could not have been attacked. It adds that many clients outside the browser ecosystem do not enforce it, and it is not known whether attackers targeted them.
- Cloudflare: it reported no active exploitation on its services and has released updated clients and mitigations.
Who still needs to act
Software that uses its own certificate store or does not check revocation keeps trusting the compromised certificates until updated. The incident tracker lists patched versions, including:
| Software | Patched version |
|---|---|
| Node.js | 26.12.1, 24.22.1, 22.23.4 |
| Go | 1.27.3, 1.26.10 |
| Python certifi | 2026.10.19 |
| curl CA bundle | 2026-10-20 |
Ubuntu, Debian, Alpine and other Linux ca-certificates |
see the tracker for your distribution |
The tracker also warns that macOS's built-in /usr/bin/curl may keep trusting them because its bundle does not check revocation.
What to do this week
- Check who issued your certificates. Open your site's certificate details and read the issuer. If it is one of the eight eMudhra intermediates, ask your provider about reissuing.
- Update servers and containers. Update the operating system's
ca-certificatespackage and rebuild container images from fresh base images. - Update runtimes and libraries. That means Node.js, Go, Java, Python and their certificate bundles, as listed above. Our Node.js security release guide covers the Node.js versions.
- Restart processes so they load the new trust store.
- Test your clients with the tracker's test endpoints. A certificate error means the client no longer trusts the compromised intermediates.
- Do not disable certificate verification to silence new errors. Cloudflare warns this removes the protection the updates provide.
- Review origin certificates if you use Cloudflare's Full (strict) mode and have custom origin certificates.
- Check code signing. If you sign software with a certificate from this CA, ask your provider what to do.
A routine of timed updates, as in our website maintenance guide, makes incidents like this a quick job instead of an emergency.
Want us to check your servers, apps and certificates? Talk to Susraj Tech.
Frequently asked questions
Do I need to replace my SSL certificate?
Only if it chains to one of the eight revoked intermediates. Check the issuer and ask your provider.
Should I disable certificate verification?
No. Update the software instead.
Sources
- Mozilla Bugzilla: eMudhra, Private key compromise of Intermediate Certificates
- eMudhra Intermediate CA Compromise: incident tracker and patched software list
- Cloudflare: 8 eMudhra certificates are compromised. Here's what you need to do
- BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
Last reviewed 22 October 2026. This article is general security information, not a guarantee of protection. Details may change as vendors publish more information.
