eMudhra Intermediate CA Compromise Hits Web PKI

This is a serious PKI failure whose blast radius extends well beyond eMudhra: browser revocation works quickly, but static developer trust stores remain exposed until patched.

• –The compromised intermediates covered DV, OV, and EV TLS certificates plus code-signing certificates.
• –Firefox, Chrome, Apple, and Microsoft deployed protections through centralized revocation and trust-store updates.
• –Go, Electron, Python certifi, Rustls, NSS, and other packages require specific updates to reject affected chains.
• –Clients that do not consume revocation data remain vulnerable to fraudulent certificate issuance.
• –Developers should audit certificate chains and update TLS libraries, operating systems, and bundled CA stores immediately.