Source: https://agentdast.com/newsletter/emudhra-certificate-authority-key-compromise

# eMudhra CA keys compromised: update trust stores and check certificate chains

[By Tornike (@realtornikeo)](https://x.com/realtornikeo)

 Published Nov 4, 2026  Last updated Nov 4, 2026 

Original sources: [eMudhra: incident statement and customer transition](https://emudhra.com/en/post/certificate-security-incident); [Mozilla: Firefox and NSS protections](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/); [Red Hat: affected products and trust-store updates](https://access.redhat.com/security/vulnerabilities/RHSB-2026-012); [Cloudflare: observations of forged certificates](https://blog.cloudflare.com/emudhra-patching/)

## Does this apply to me?

**Firefox and NSS** Exposure depends on trust-list updates and configuration 

Standard Firefox configurations received a remote blocklist update. Custom settings can prevent that update.

Action: Firefox 158.0.1, ESR 115.43.1 and 153.5.1; Android 158.0.2 addresses a blocklist startup issue. NSS 3.131.1 updates its trust store.

**Red Hat Enterprise Linux trust store** RHEL 6, 7, 8, 9 and 10 with an affected ca-certificates package 

TLS applications using a trust store that still accepts the compromised hierarchy.

Action: Apply the updated ca-certificates package for the deployed release; check Red Hat's advisory.

## How severe is it?

**Critical for exposed trust paths**

An attacker able to intercept a connection could use a forged certificate to impersonate a service and read or change traffic if the client accepts it. Red Hat rates its affected products Critical.

Red Hat's product rating and Tornike's assessment of unprotected TLS clients. The interception risk depends on trust and network position.

First reported Oct 17, 2026

`CVE-2026-114406`

## What happened

On October 17, 2026, Mozilla received a report that eight eMudhra intermediate CA private keys were compromised. eMudhra attributes the weak keys to a script error and says it revoked the intermediates on October 18. Mozilla and other vendors changed their trust lists.

TLS clients that still trust the affected hierarchy can accept forged certificates. Trust decisions vary by application, operating system and configuration. Website certificates chaining to removed roots can also stop working for updated clients.

## What to do now

1.  Update OS and application trust stores. Rebuild containers with updated base images and redeploy them. Check separately bundled trust stores.
2.  Check the full certificate chains served by your websites and APIs. Replace certificates that depend on roots removed by clients, or use an alternative trusted chain.
3.  Verify the actual TLS path used by each service, including outbound API clients. A browser update alone does not establish that a server application is protected.

## What this means for your website

Cloudflare observed forged certificates after disclosure and reported no evidence that they intercepted its connections. eMudhra says the affected intermediates had issued no publicly trusted end-entity certificates. Broader distrust can still disrupt legitimate sites using other certificates under affected roots.

## Sources and updates

-   [eMudhra: incident statement and customer transition ↗](https://emudhra.com/en/post/certificate-security-incident)
-   [Mozilla: Firefox and NSS protections ↗](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/)
-   [Red Hat: affected products and trust-store updates ↗](https://access.redhat.com/security/vulnerabilities/RHSB-2026-012)
-   [Cloudflare: observations of forged certificates ↗](https://blog.cloudflare.com/emudhra-patching/)

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

### Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

[Set up your agent →](https://agentdast.com/agents)

## Keep reading

-   [Linux TCP flaw: update the kernel on website hosts](https://agentdast.com/newsletter/linux-ipv4-tcp-use-after-free-cve-2026-98432)
-   [Node2Shell: update Brotli decoders across your website stack](https://agentdast.com/newsletter/node2shell-brotli-cve-2026-111497)