What Happens to Your Site When a Certificate Authority Is Compromised? The eMudhra Incident, CAA Records and Certificate Transparency Monitoring

In brief: According to TechCrunch on 21 October 2026, the private keys of the Indian certificate authority eMudhra were compromised, which could let attackers issue fraudulent certificates and impersonate legitimate sites. The report relays security professionals calling the cleanup a “bigger than Heartbleed” job (indirectly reported). The Node.js project, in security releases the same day, updated its CA certificate store in connection with this incident (“eMudhra Intermediate CA compromise”). When browsers and operating systems remove a CA from their trust lists, all certificates it issued become invalid; so the impact depends on who obtained certificates from it. Three low-cost measures for your site: a CAA DNS record, Certificate Transparency monitoring and a certificate renewal/automation plan. This article explains how HTTPS trust works and what businesses can do. Details of the incident may develop; our sources are the TechCrunch report and the Node.js announcement (23 October 2026). I found no further primary sources on the scope of the incident.

Last updated: 23 October 2026

How does HTTPS trust work?

When you connect to a site in a browser, the server presents a TLS certificate. The browser checks: was this certificate signed by a certificate authority (CA) that the browser (or operating system) trusts? Does the domain match the name in the certificate? Has it expired?

This chain of trust rests on hundreds of CAs worldwide. If a CA's private key is stolen, an attacker can produce fake certificates that look valid for any domain in that CA's name. If the attacker can also intercept network traffic (café Wi-Fi, a compromised router, a DNS attack), they can show the user a fake site with a “padlock.”

The eMudhra incident: what is known

• According to TechCrunch, the private keys of the Indian certificate authority eMudhra were compromised, which could allow fake certificates to be produced.
• The same report relays that security professionals called the cleanup a “bigger than Heartbleed” job.
• Node.js's 21 October security release includes an update to its CA certificate store related to “eMudhra Intermediate CA compromise.” This means the runtime has removed the intermediate certificate in question from its trust list. See our Node.js security release article for details.

What we don't know: the scope of the attack, how many certificates were forged or whether they were actually abused. So the “risk to your site” depends on whether you obtained certificates from eMudhra and in which region your users are.

What happens when a CA is compromised?

1. Browser/OS vendors remove trust in that CA (or its intermediate); this is distributed as an update.
2. Sites with certificates from that CA may need to renew them from another CA because their certificates are no longer trusted.
3. Attacks carried out with fake certificates can be tracked in Certificate Transparency (CT) logs, because browsers generally don't accept certificates that haven't been recorded in public logs.
4. If software (Node.js, the operating system, mobile apps) doesn't pick up the current trust list, it keeps working with the old trust list. That is why runtime updates matter.

3 low-cost measures for your site

1. A CAA DNS record: decide who may issue certificates

A CAA (Certification Authority Authorization) DNS record states which CAs may issue certificates for your domain. CAs must check this record before issuing. You can list the CA you use (e.g. Let's Encrypt) and block the others. Even if a CA is compromised, this makes it harder for an attacker to force a fake certificate for your domain (through CAs that follow the rules). Limit: a compromised CA can bypass the rules; but it narrows the attack surface.

2. Certificate Transparency monitoring

All valid certificates are recorded in public CT logs. If you set up a monitoring service (many security and certificate tools offer one) that alerts you when a new certificate is issued for your domain, you notice certificates issued without your knowledge. That means detection in days, not weeks.

3. Certificate inventory and automatic renewal

• List which domain, subdomain and service uses which certificate from which CA.
• Renew certificates automatically (protocols like ACME) and know how long it takes to switch CAs.
• For critical services keep a backup CA option ready; you must be able to switch quickly if a CA falls out of trust.

Notes for application developers

• In mobile/desktop apps that do certificate pinning, a CA change can break your app; design pinning to be updatable and redundant.
• Keep runtimes and operating systems current: the Node.js security release also refreshes the CA store.
• In applications that bundle their own trust store (Docker images, single-file apps) rebuild the image.
• For internal services that connect by IP address, TLS hostname verification matters: the same Node.js release also fixed separate flaws in this area.

For your users and staff

• Don't skip browser and operating system updates.
• Avoid sensitive transactions on public Wi-Fi; a VPN and multi-factor authentication give extra protection.
• If the browser shows a certificate warning, don't dismiss it.

6 questions for businesses

1. Which CAs do our domains use for certificates? Which are eMudhra?
2. Do we have a CAA record?
3. Is Certificate Transparency monitoring set up?
4. Are certificate renewals automatic? How quickly can we move to another CA?
5. Do our mobile/desktop apps use certificate pinning? Can it be updated?
6. Are our runtimes and container images running with the current trust list?

For general security measures see our web application security guide and for an urgent patch routine our patch management article.

Secure infrastructure with Aktaş Digital

We plan infrastructure topics like domains, DNS, certificate management and monitoring at the start of a project; for existing sites we can set up CAA, CT monitoring and a certificate inventory. To get a scope and cost breakdown, use our quote form. Related services: web applications.

Frequently Asked Questions

What should I do if my site uses an eMudhra certificate?

Follow announcements from your CA and from browser/OS vendors; if needed obtain your certificate from another CA. If unsure, check the certificate's issuer and ask your infrastructure team for written information.

Does a CAA record fully protect me?

No; it prevents rule-following CAs from issuing certificates for you. Assume a compromised CA could bypass the rules. That's why you should use it together with CT monitoring.

Are my users in danger?

The risk depends on whether the attacker can intercept traffic and whether fake certificates are actually used. There isn't enough primary information on the incident's scope.

Is Certificate Transparency monitoring paid?

Many tools offer free or low-cost monitoring. Evaluate options with your infrastructure team.

Do I need to update Node.js?

Yes; the 21 October releases updated the CA store and closed other security flaws. See our Node.js article.

Conclusion

HTTPS trust rests on the integrity of a few hundred CAs; when one's key is compromised, the effect can spread across the web. You can't choose the CA's security but with a CAA record, CT monitoring and automatic renewal you can reduce both your risk and your reaction time. The first thing you can do today: list which CAs your domains use for certificates and check whether a CAA record exists.