Andrew Ayeragwa@agwa.name
Oct 20, 2026, 1:49 PM"private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control."
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
Web browsers are already protected because their certificate verifiers are good. Go and rustls/webki have released security updates that explicitly block the intermediates and you should upgrade if you ship software using these libraries. No word yet from OpenSSL.
IMO, the easiest and most thorough mitigation is to remove the following roots from your trust store, so that you don't have to rely on certificate verifiers to block the intermediates:
- AAA Certificate Services
- anything from eMudhra or emsign
Removing the AAA root should have no collateral damage provided your trust store is up-to-date (specifically: it has Sectigo's newer roots). In fact, Mozilla and Chrome removed this root months ago.
Removing the eMudhra/emsign roots will cause some sites to break but this compromise is so bad that it calls into question their entire operation and possibly their auditor.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
Web browsers are already protected because their certificate verifiers are good. Go and rustls/webki have released security updates that explicitly block the intermediates and you should upgrade if you ship software using these libraries. No word yet from OpenSSL.
IMO, the easiest and most thorough mitigation is to remove the following roots from your trust store, so that you don't have to rely on certificate verifiers to block the intermediates:
- AAA Certificate Services
- anything from eMudhra or emsign
Removing the AAA root should have no collateral damage provided your trust store is up-to-date (specifically: it has Sectigo's newer roots). In fact, Mozilla and Chrome removed this root months ago.
Removing the eMudhra/emsign roots will cause some sites to break but this compromise is so bad that it calls into question their entire operation and possibly their auditor.