Eight intermediate certificate authorities had private keys weak enough for an outsider to recover. That’s the eMudhra incident. No rack of stolen HSMs. No burglar with a backup tape. The public keys gave the game away.
An intermediate CA key signs certificates. If you can recover that key, you can mint a certificate for a domain you don’t own. You still need to get between the victim and that domain to use it, but the browser’s ordinary chain check may then bless your forgery. This is precisely why we have root programs, revocation machinery, and people who lose sleep over key ceremonies.
The Mozilla incident record says a researcher reported proof of control for eight keys on October 17. Mozilla independently recovered them that evening. eMudhra revoked the eight intermediate certificates on October 18. Six were TLS issuers; two were for code signing. Sectigo had cross-signed some of the same keys, so those certificate copies needed attention too. A different certificate around the same public key is still the same compromised key. Cryptography does not care whose stationery you used.
Firefox blocked the intermediates through OneCRL. Chrome blocked the affected TLS keys by their public-key hashes in CRLSet, which also covered the cross-signed copies. Mozilla then moved to remove trust in emSign ECC Root CA - G3 from NSS, and Chrome committed to the same course. Root removal is wider than blocking eight bad intermediates. Anything that still chains to G3 needs a new path before clients with updated trust stores stop accepting it.
Keep two groups of certificates straight. eMudhra says the eight weak intermediates issued no end-entity certificates. That is its reported finding about those eight keys. Separately, eMudhra estimated in the Mozilla incident discussion that roughly 30,000 existing certificates chained to the G3 root and would need migration after the root decision. These are different populations. Saying the eight had issued no leaf certificates does not make the root migration disappear.
eMudhra says the weak keys came from an April 2025 ceremony and that it is still investigating the exact failure. Its account says seven intermediates were never deployed in production and the eighth issued nothing. The root private key itself was not reported compromised. Mozilla’s decision to distrust the root is a containment decision for clients that cannot reliably revoke individual intermediates, not a claim that somebody recovered the root key.
And now eMudhra says it will leave the global SSL/TLS certificate business. It plans to keep status services running during the transition and supply replacement certificates through partners. That’s a business decision announced October 22, not proof that every customer has already migrated.
For users: take the browser and OS trust-store updates. For operators: inventory applications that validate outbound TLS, including containers, language-specific bundles, proxies, and long-running processes. Update the trust path each one actually uses and test it. Cloudflare’s response notes the trap: a passing browser or curl check tells you nothing about a service using another bundle. If an updated client starts rejecting a certificate, replace the certificate or its chain. Turning verification off is how a CA incident becomes your incident.
This was an unusually fast browser response to an unusually embarrassing failure. The slow part is the ordinary software that imported yesterday’s trust decisions and never came back for today’s.