TECH giants moved quickly to block eight certificates tied to compromised eMudhra keys after researchers demonstrated that the private keys for eight intermediate certificate authorities could be misused to sign fraudulent certificates. The affected keys were associated with six TLS intermediates (EM DV TLS CA, EM OV TLS CA, EM EV TLS CA, each as G3B and G3C variants under emSign Root TLS CA - G3) and two code-signing intermediates (EM OV CS CA - G3B and EM OV CS CA - G3C under emSign Root CS CA - G3).
The moves by Google, Mozilla, Apple and the Go project aim to prevent browsers and applications from trusting certificates issued with these compromised keys, reducing the risk of impersonation and interception of encrypted communications.
The public guidance notes that revocation alone is not sufficient for all users or software; Mozilla, Google and Apple distributed blocks via their revocation mechanisms, while Go-based software requires patched builds (Go versions 1.27.3 and 1.26.10) to stop trusting the affected intermediates.
Mozilla indicated the initial block arrived about three hours after learning of the issue; Google described addressing the matter within Chrome’s trust boundary and working with CT log maintainers to reject certificates chaining to the compromised CAs going forward. Evidence of exploitation remains unclear, though a researcher identified as Wayne demonstrated access to the private keys by signing a simple message, prompting the rapid remediation.
Officials emphasised updating operating systems and browsers to the latest versions, as revocation lists alone do not reach all clients. The root cause and scope beyond these eight intermediates have not been disclosed.