What happened
According to a headline trending on Hacker News, eMudhra's intermediate certificate authority was compromised. The source offers no details on how the breach occurred, how many certificates are affected, or when it was detected.
Why an intermediate CA matters
In the certificate chain, the root CA sits at the top, while intermediate CAs issue site certificates on the root's behalf. If an intermediate CA's private key is stolen, an attacker can mint certificates that browsers trust and impersonate domains.
What to do
- Sites using certificates signed by eMudhra should check their certificates and chains.
- Organizations should monitor Certificate Transparency logs for unexpected certificates issued for their domains.
- Keep an eye on trust store updates from browser and operating system vendors.
The story should be updated once the official scope and eMudhra's response become clear.
