# Eight eMudhra CA keys compromised: browsers block forged TLS chains as operators face certificate migration Eight eMudhra intermediate CA private keys were compromised through weak key generation. Chrome and Firefox pushed emergency distrust, Cloudflare patched client and tunnel software, and Chrome plans to remove the issuing root on October 27. The incident affects certificate validation, not TLS encryption. Website operators with certificates under the affected root and developers shipping custom trust stores must assess and migrate; disabling verification is not a fix. - Status: Active - Published: 2026-10-21T19:17:30+13:00 - Updated: 2026-10-21T19:17:30+13:00 - Categories: Cloud & Infrastructure, Edge & CDN - Tags: browser security, security, TLS - Canonical HTML: https://beyondthe.news/dossiers/emudhra-eight-intermediate-ca-keys-compromised-browser-root-trust-october-2026 ## What changed On October 17, 2026, Chrome and Mozilla received reports of compromised private keys associated with eight eMudhra intermediate certification authority certificates. Google says the keys were generated with insufficient entropy, allowing fraudulent certificates to be created for arbitrary domains. Chrome deployed CRLSet blocks and Mozilla distributed OneCRL revocations on October 17; Mozilla released Firefox 158.0.1 and ESR security builds October 20 for clients missing remote revocation. Google plans to remove emSign ECC Root CA - G3 from the Chrome Root Store for general devices on October 27, potentially breaking legitimate chains under that root. Cloudflare updated WARP/One clients and cloudflared 2026.10.2, plus server-side mitigations. eMudhra says the eight affected intermediate keys did not issue end-entity certificates, but this does not make the key compromise harmless. ## Why it matters Trusting a compromised intermediate CA can let a network-positioned attacker present a forged certificate for another website. Browser emergency revocation protected standard configurations quickly, but background services, pinned/custom trust stores, outdated images and client libraries may not receive browser revocation updates. Operators with certificates chaining to the distrusted root face real breakage and must migrate certificates, while service developers need to check the TLS verifier actually used by each workload. ## What was compromised and what is known Google's Chrome Root Program and Mozilla both confirmed eight intermediate CA private keys with inadequate entropy. The issue concerns authentication of server certificates, not a flaw in TLS ciphers. eMudhra says no end-entity certificates were issued by the affected intermediates and that the root private keys were not compromised; those are company claims under investigation. No confirmed widespread exploitation has been established in the cited incident notices. ## Emergency browser and root-store responses Chrome blocked affected public keys through CRLSet on October 17, without waiting for a full browser release. Mozilla OneCRL reached standard Firefox configurations within hours and Firefox 158.0.1 plus ESR 115.43.1/153.5.1 followed October 20 for atypical settings. Chrome plans to remove emSign ECC Root CA - G3 from its root store on October 27; some legitimate certificates chaining to that root will then fail validation. Mozilla is updating NSS trust roots as well. ## Cloudflare-specific mitigations and action Cloudflare says its CDN and Zero Trust mitigations were deployed by October 20, and directs WARP/Cloudflare One users to updated clients and cloudflared operators to 2026.10.2. Customers using custom mTLS trust stores, Full (strict) origin validation or container images must assess their own certificates and trust stores; application-specific TLS stacks can remain exposed even if the user's browser is patched. ## Practical validation without weakening TLS Inventory origin and client certificates issued under the affected eMudhra root, replace affected chains using an unaffected CA, update operating-system and language-runtime trust stores and redeploy affected services. Verify from the application's actual TLS path, not only a browser or curl test. Certificate errors after distrust should be resolved by replacing the chain, not by disabling certificate verification. ## Key details - Eight intermediate eMudhra CA private keys compromised; Chrome and Mozilla received reports October 17, 2026. - Chrome CRLSet and Firefox OneCRL emergency blocks were delivered without requiring normal browser updates for standard clients. - Firefox 158.0.1 and ESR 115.43.1/153.5.1 released October 20 for additional coverage. - Chrome expects to remove emSign ECC Root CA - G3 from the Chrome Root Store October 27, 2026. - Cloudflare recommends cloudflared 2026.10.2 and updated WARP/One clients. - eMudhra says affected intermediates issued no end-entity certificates; ongoing investigation. ## Builder takeaways - Check actual certificate chain and trust store used by origin servers, API clients, reverse proxies, containers and custom mTLS clients. - Replace certificates chaining to the root scheduled for distrust rather than turning off TLS validation. - Patch browser clients, OS trust stores, runtimes and cloudflared/WARP where relevant; restart or redeploy services to activate changes. - Monitor certificate-validation errors and vendor trust-store advisories through the October 27 Chrome root-removal window. ## What to watch - Chrome Root Store removal on October 27 and downstream breakage reports. - eMudhra final incident analysis, affected certificate migration and any verified misuse. - NSS and other OS/runtime trust-store updates; potential changes to remaining eMudhra root trust. ## Uncertainties - No established number of exploited connections or affected customers. - eMudhra's no-end-entity-certificates statement is company-reported; root-removal can still break legitimate unrelated certificates. - Different clients and bundled trust stores may adopt revocation on different schedules. ## Sources - [Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) — Google Chrome Security · primary incident report · 2026-10-20T00:00:00+13:00. Weak entropy, CRLSet block and October 27 root removal. - [Protecting Firefox users following the compromise of eMudhra intermediate certificates](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) — Mozilla Security · primary incident report · 2026-10-20T00:00:00+13:00. OneCRL, Firefox and NSS mitigation timing. - [8 eMudhra certificates are compromised. Here's what you need to know](https://blog.cloudflare.com/emudhra-certificate-compromise/) — Cloudflare · primary operator response · 2026-10-20T00:00:00+13:00. Cloudflare-specific software versions, origin and custom trust-store guidance. - [eMudhra Statement on Recent Certificate Security Incident](https://emudhra.com/en/post/certificate-security-incident) — eMudhra · company statement · 2026-10-20T00:00:00+13:00. Company-reported limits and ongoing investigation; not independent proof of no misuse.