Updated 22 October 2026. Free operational guide.
Check every application's certificate trust source. A protected browser does not establish that command-line tools, containers or language runtimes reject the compromised keys.
Does this apply?
Eight eMudhra intermediate CA keys were compromised through faulty generation; six were for TLS and two for code signing. Clients still trusting them could accept forged certificates. Mozilla's trust-store advisory explains the affected chains and why revocation alone is insufficient for clients that do not reliably enforce it.
Choose your platform
| Surface | Action and limit |
|---|---|
| Chrome | The October 17 CRLSet block needed no restart. For websites, inspect your served chain: Google expects emSign ECC Root CA - G3 removal on October 27, morning PDT. Replace certificates chaining to it with another trusted hierarchy before then. |
| Android | Google says Play Services delivered equivalent protection around October 19, 22:00 UTC. Restarting can trigger the update. Check managed-device delivery instead of assuming receipt. |
| Firefox | Standard configurations received OneCRL. Update custom configurations to 158.0.1, ESR 115.43.1, ESR 153.5.1, or newer. Other NSS consumers need 3.131.1 or a documented backport. |
| Ubuntu | Update ca-certificates. Fixed builds are 20260816ubuntu0.22.04.1, 20260816ubuntu0.24.04.1, 20260816ubuntu0.26.04.1, and 20260816ubuntu0.26.10.1 for those releases. Older systems have ESM-specific builds. Browser snaps update separately. |
| Windows | The original incident tracker reports automatic certificate trust-list blocks from October 20. Verify delivery; offline or update-disabled systems need managed remediation. |
| macOS command-line tools | The tracker distinguishes Apple's revocation protection from built-in curl, git, python3, perl, ruby and openssl, which read /etc/ssl/cert.pem without revocation checks. Built-in pip has another bundle. Use updated tooling or reviewed administrative remediation. |
| Bundled stores | Inventory each application/image. The tracker lists fixes including certifi 2026.10.19, pip 26.2.2, and curl's 2026-10-20 CA bundle. Rebuild shipped artifacts containing old stores. |
Google supplies the Chrome, Android and website-operator guidance. Mozilla supplies the Firefox versions. Use Ubuntu's release table and the original coordination tracker for other packages and workarounds. Apple/Microsoft incident status here is attributed to that tracker.
First actions
- In the asset inventory, list each TLS client, owner, package version and actual trust source. Include services inside containers and application-specific bundles.
- Apply the appropriate vendor update through your normal trusted channel. Record the package revision or managed-policy receipt.
- Replace affected website certificate chains through your certificate-management process. Test the deployed chain on every serving endpoint you own.
- Restart or redeploy consumers where needed to load changed trust data. Keep an owner against devices that cannot receive an update.
Verify and close
Retain the inspected build/store identity, applied update and successful ordinary TLS integration checks. Where an administrator validates distrust, use the coordinator's offline chain procedure in a controlled environment. Confirm a certificate-validation rejection; a DNS or network error is not that result. Cover relevant cross-signed chains.
Close only the listed applications and stores. Keep unknown consumers open, with an owner and follow-up date.
Avoid these mistakes
Do not disable TLS verification to repair broken connections. Broad root removal can also reject legitimate certificates; use vendor guidance and test compatibility. Do not run blanket system-file edits copied from a headline. CT-enforcing browser protection does not prove historical safety for every non-browser or code-signing use.