eMudhra's eight compromised intermediates expose non-browser TLS clients

On 17 October 2026, eight intermediate certificate authorities run by eMudhra were reported compromised: six TLS and two code-signing. The P-384 keys generated at a 30 April 2025 ceremony were effectively tiny integers (one was literally 4), making every certificate issued under them forgeable. Mozilla, Google, Apple and Microsoft blocked them by 20 October, but clients that rely on their own trust stores and skip Certificate Transparency remain exposed.

• Eight eMudhra intermediates compromised: six TLS, two code-signing
• P-384 keys were tiny integers, one of them literally the number 4
• Browsers blocked the certs within 3–4 days; eMudhra revoked all eight
• Go, Rust and curl need rebuilds or updated bundled trust stores