The private keys of eight eMudhra intermediate certificate authority certificates are compromised, the Mozilla and Chrome root programs confirmed on 20 October. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any domain that a browser would accept. A researcher reported the compromise at 18:05 UTC on 17 October; Chrome had a CRLSet blocking the six TLS intermediates live by 19:45 UTC and Mozilla finished pushing a OneCRL block to Firefox at 22:59 UTC — neither required a browser update or restart. The eight certificates include the DV, OV and EV TLS intermediates G3B and G3C plus two OV code-signing intermediates; the six TLS ones chain to emSign ECC Root CA G3, which was pulled from Mozilla's root store. Chrome's block matches the public key, so it also catches Sectigo cross-signed copies. No TLS certificate chaining to the six intermediates had been logged to Certificate Transparency, so none could have been trusted by default. It is not known how, when or to whom the keys left eMudhra; Go blocked the same eight in its 20 October releases.

• Source article