REPORTED DEVELOPMENT
A key-generation defect made private keys reconstructible for eight eMudhra intermediate certificates, six for TLS and two for code signing. The issue was reported on 17 October; eMudhra revoked the certificates on 18 October. Google and Mozilla distributed Chrome and Firefox protections. Google plans removal of an eMudhra root from Chrome Root Store on 27 October, potentially affecting legitimate certificates relying on that hierarchy.
eMudhra says affected intermediates issued no end-entity certificates and root keys were not compromised.
WHY IT MATTERS TO THE MARKET
Browser protections do not automatically cover backend TLS libraries or different trust stores. Effective integration trust chains require separate evaluation.