Eight private keys from an Indian certificate authority are in the open. Any one of them could impersonate any website
The web’s trust model puts a few hundred certificate authorities in a position where one bad week at any of them is everyone’s problem.
One compromise at a Bengaluru CA became a global browser emergency in three days.
A researcher proved he held the keys by signing with each one. They chain up to roots trusted by Mozilla, Microsoft, Apple, and Chrome. Firefox and Chrome blocked them on October 17, Apple on the 19th, and Microsoft on the 20th. eMudhra has revoked them, but a lot of clients never check revocation, so embedded devices and anything with a custom trust store will need a software update.
My read: the web’s trust model puts a few hundred certificate authorities in a position where one bad week at any of them is everyone’s problem.
Your pick: check whether your services still trust these intermediates. The source has a live checker. And don’t assume revocation covers your non-browser clients.
Why I may be wrong: the big four root programs moved fast, so everyday users are largely safe.
But when did your org last audit what its systems trust?