The private keys of eight intermediate certificate authority (CA) certificates belonging to eMudhra have been compromised, as confirmed by both Mozilla and Google's Chrome Root Program on October 20. These keys, crucial for signing website certificates, were reported compromised by a researcher on October 17, leading to emergency actions by major web browsers. Within hours, both Chrome and Firefox had blocked the affected certificates to prevent their misuse.

The compromised keys, used by eMudhra's emSign brand, were not detected in any previous Certificate Transparency logs, indicating no prior unauthorized use in browsers that require such logging. While the exact circumstances of how these keys were compromised remain unknown, they were promptly revoked by eMudhra, with key blocks implemented across various platforms including Apple's and Microsoft's systems by October 20.

Chrome utilized its CRLSet to block the affected TLS intermediates, ensuring that no rogue certificates could be issued. Similarly, Mozilla applied its OneCRL block to Firefox installations to maintain security integrity. These swift actions ensured that the risk posed by the compromised keys was contained, although the underlying cause and any potential further implications are still under investigation.

While Mozilla and Chrome have determined that no other certificate authorities were affected, they recommend operators of trust stores to block these intermediates or consider removing trust in the related roots. In addition, revocation checks are necessary for continued protection, as some programs do not automatically update these changes.

The response to this incident underscores the importance of maintaining robust security protocols and the rapid coordination required to address potential threats to the digital ecosystem. eMudhra's failure to prevent the key compromise serves as a reminder of the critical need for vigilance in managing digital certificate security.