Eight eMudhra Intermediate CA Private Keys Compromised, Prompting Emergency Browser Fixes

What happened

The private keys for eight eMudhra intermediate certificate‑authority certificates were leaked. Mozilla and Google’s Chrome Root Program confirmed the compromise on 20 Oct 2026 and removed the affected intermediates from their browsers’ trusted stores.

Why it matters for trust and compliance

• This event tests the control objective of third‑party PKI key‑management and trust‑anchor oversight, a core element of a continuous control‑assurance program that must provide evidence of due diligence and timely remediation.
• Demonstrates the need for continuous monitoring of third‑party certificate authorities as part of audit‑ready evidence.
• Provides a concrete example of why documented key‑management controls and revocation processes are essential for compliance readiness.

Who is affected

Recommended actions

1. Re‑issue and replace all certificates signed by the compromised intermediates.
2. Revoke the affected intermediates in all public and private trust stores.
3. Audit your PKI supply‑chain for certificate provenance and collect remediation evidence.
4. Enable continuous third‑party risk monitoring for real‑time alerts on CA key‑compromise events.