--- title: Eight compromised certificate authority keys | OpenVPN Blog description: Eight eMudhra CA keys were found compromised. Here's what happened, why it matters beyond your browser, and the updates to make now. image: https://blog.openvpn.net/hubfs/7aab7326-d95b-4a38-8e21-1eda1af990d2.png --- - [Blog](https://blog.openvpn.net) - [Industry News](https://blog.openvpn.net/tag/industry-news) # Eight compromised certificate authority keys: what happened and what to update now Oct 22, 2026 • 3 min read ![compromised security key](https://blog.openvpn.net/hubfs/7aab7326-d95b-4a38-8e21-1eda1af990d2.png) Share - - - - Eight compromised certificate authority keys | OpenVPN Blog 4:31 By Heather Walters ## The bottom line: update everything, as soon as possible. On October 17, 2026, a security researcher found that the private keys behind eight intermediate certificate authority (CA) certificates from eMudhra could be recovered in milliseconds. Anyone holding those keys could issue certificates for any website that browsers and apps would trust as real. This strikes at the trust model that secures almost everything online, from web browsing to software updates to the connections your own tools make behind the scenes. Browser vendors moved fast, but not every program gets the fix automatically. The short version: update your operating systems, browsers and certificate bundles now. Here's what happened and the steps we recommend. ## What happened Certificate authorities vouch for websites. Your browser trusts a site's certificate because it chains back to a CA it already trusts. If a CA's signing key leaks, an attacker can mint convincing certificates for any domain, and your software has no easy way to tell them apart from the real thing. That is what happened here. Eight eMudhra intermediate CA keys (six for TLS, two for code signing) were generated in April 2025 with almost no randomness. Each could be recovered by testing about 256 possible values. Because the keys could be worked out from the public certificates themselves, they have been exposed since April 2025, not just since this month's discovery. eMudhra has attributed the problem to a script error and says it found no evidence the keys were used to issue certificates to end users. The response so far: - **Google Chrome** blocked the six TLS intermediates on October 17, with no browser update needed, and pushed the block to Android on October 19. - **Mozilla Firefox** blocked them on October 17 and shipped Firefox 158.0.1 and ESR updates on October 20. - **Apple** added protections on October 19 and **Microsoft** on October 20. - **Go, Python certifi, Rust webpki-roots, NSS, curl** and several Linux distributions have released updated certificate bundles. Debian, FreeBSD and Node.js (22.23.4, 24.22.1 and 26.12.1) have since followed. Bun, Bottlerocket and Erlang's certifi package were still pending as of October 22. The gap is software that keeps its own certificate store or doesn't check revocation. Those programs keep trusting the compromised keys until they are updated. ## What you should do now 1. **Update your operating systems.** Install the latest ca-certificates (or equivalent) package on every server and endpoint, and rebuild base images and containers so they pick it up. 2. **Update your browsers.** Chrome, Firefox, Safari and Edge have pushed blocks, but a restart and update make sure you have them. If Firefox's Remote Settings is disabled by policy, install Firefox 158.0.1 or the latest ESR. 3. **Update software with its own certificate bundle.** That includes apps built with Go, Python (certifi), Rust, Node.js and Electron. Rebuild Go programs with Go 1.27.3 or 1.26.10. 4. **Check on pending fixes.** A few packages, including Bun and Bottlerocket, were not yet updated as of October 22. Recheck and apply them as they land. 5. **Replace affected certificates.** If any of your own sites use a certificate chaining to emSign ECC Root CA - G3, replace it with one from another CA before browsers remove that root. ## The bottom line There's no evidence these keys were abused, but the safe assumption is that they could have been. A few minutes spent updating certificate packages today closes the door. If you have questions, [contact our support team.](https://support.openvpn.com/) ## Further reading - [eMudhra Intermediate CA Compromise advisory and patch tracker](https://emudhra.we-have-a-problem.com/) - [Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) - [BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates](https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/) [Heather Walters](https://blog.openvpn.net/author/heather-walters) Heather is a writer for OpenVPN. ## Related posts from OpenVPN ### [![This Week in Cybersecurity: AI Hacks AI](https://blog.openvpn.net/hubfs/social-suggested-images/3%20(4).png) Cybersecurity Nov 21, 2025 This Week in Cybersecurity: AI Hacks AI](https://blog.openvpn.net/this-week-in-cybersecurity-ai-hacks-ai) ### [![Self-Hosting a VPN Behind CGNAT, a Dynamic IP, and a Consumer Router](https://blog.openvpn.net/hubfs/Hobbyists-1250x360-5.png) Zero Trust Oct 16, 2026 Self-Hosting a VPN Behind CGNAT, a Dynamic IP, and a Consumer Router](https://blog.openvpn.net/self-hosted-vpn-cgnat-dynamic-ip-home-router) ### [![Tailscale and Headscale Alternatives for Homelabbers Who Want the Control Plane Too](https://blog.openvpn.net/hubfs/Hobbyists-1200x630-2-Social-and-OG-Size.png) Zero Trust Oct 13, 2026 Tailscale and Headscale Alternatives for Homelabbers Who Want the Control Plane Too](https://blog.openvpn.net/tailscale-headscale-alternatives-self-hosted-control-plane) ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Heather Walters", "url" : "https://blog.openvpn.net/author/heather-walters" }, "dateModified" : "2026-10-22T13:46:05.036Z", "datePublished" : "2026-10-22T13:46:05.000Z", "headline" : "Eight compromised certificate authority keys | OpenVPN Blog", "image" : [ "https://blog.openvpn.net/hubfs/7aab7326-d95b-4a38-8e21-1eda1af990d2.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/eight-compromised-certificate-authority-keys-what-happened-and-what-to-update-now", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ```