eMudhra Intermediate CA Compromise

The private keys of eight eMudhra intermediate CA certificates have been compromised, and they chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs. Wayne demonstrated the compromise by signing a message with each key and reported it on 17 October, and Firefox and Chrome have blocked the certificates since that date. Mozilla, Apple and Chrome have also distributed revocation data, but many other clients need software updates. An attacker holding any of the keys could impersonate any website or service.