Mozilla and Google have confirmed that private keys for eight eMudhra intermediate certificate authority certificates were compromised. Because intermediate CA keys are used to sign website certificates, the incident creates a serious trust risk: an attacker with those keys could potentially issue certificates that browsers may accept as valid until emergency trust updates are applied.

For European businesses, this is not just a technical issue for certificate authorities and browser vendors. It can affect website availability, customer trust, application security and internal systems that depend on public key infrastructure.

What happened

According to Mozilla and Google’s Chrome Root Program, the private keys of eight eMudhra intermediate CA certificates were compromised. In a public trust model, an intermediate CA sits below a root certificate and is used to sign end-entity certificates for websites, services and other digital systems.

If an intermediate CA private key is exposed, whoever controls that key may be able to create fraudulent certificates for domains or services. Those certificates could be used in impersonation attacks, man-in-the-middle scenarios or other forms of interception if relying software still trusts the affected chain.

The reported response has triggered emergency remediation across browsers and software ecosystems. Such responses typically involve trust-store updates, revocation actions or additional restrictions, although businesses should rely on official vendor guidance for the exact technical changes affecting their environments.

Why it matters for European businesses

This type of compromise affects the trust layer behind HTTPS and other certificate-based security. For businesses, that can have direct operational consequences.

• Website trust and uptime: if a company uses certificates that chain to affected intermediates, browsers or applications may begin rejecting those certificates after vendor updates.
• Customer experience: users may see certificate warnings or blocked pages, which can damage conversion rates, support workloads and brand trust.
• Internal systems: VPNs, APIs, mail gateways, enterprise applications and device management systems can also depend on certificate chains that may be impacted.
• Security exposure: a compromised CA key raises the risk of fraudulent certificates being used to impersonate services if systems have not yet received trust updates.
• Compliance and risk management: organisations in regulated sectors may need to document remediation steps and assess whether any critical services were exposed to certificate-related trust failures.

For SMEs, the main risk is often indirect. A business may not know which CA chain its website host, CDN, SaaS platform or managed IT provider uses. That means the issue can surface through suppliers as much as through in-house infrastructure.

Who may be affected

• Companies using TLS certificates issued through eMudhra or resellers relying on its certificate chain
• E-commerce businesses where browser trust warnings could disrupt checkout and customer confidence
• IT teams managing public websites, APIs, email security, VPNs and customer portals
• Managed service providers, hosting firms and digital agencies responsible for client infrastructure
• Regulated businesses that must maintain strong control over digital identity, encryption and service availability

Even organisations that do not directly buy certificates from eMudhra may be affected if a provider in their stack uses the affected certificate hierarchy.

What companies should consider

• Identify certificates in use: inventory public-facing and internal certificates, including those managed by hosting providers, cloud platforms and third parties.
• Check issuing chains: confirm whether any active certificates chain back to the affected eMudhra intermediates.
• Monitor vendor guidance: review notices from browser vendors, operating system suppliers, hosting providers and security vendors for remediation timelines.
• Prepare certificate replacement: if affected certificates are found, plan reissuance and deployment quickly to reduce service disruption.
• Test critical services: verify websites, APIs, login systems, payment flows and mobile applications across major browsers and devices after trust-store updates.
• Review third-party dependencies: ask SaaS providers, MSPs and web partners whether any of their services depend on the affected chains.
• Strengthen certificate governance: maintain an up-to-date certificate inventory, ownership record and renewal process so emergency replacements can be handled faster.

At this stage, the confirmed fact is that Mozilla and Google have identified the compromise of eight eMudhra intermediate CA private keys. Businesses should avoid assumptions about direct exposure until they verify their certificate chains and supplier dependencies, but the issue is significant enough to justify immediate review of internet-facing and certificate-dependent systems.