HTTPS and the Padlock: What the eMudhra CA Mess Teaches Online Stores
By Arash Latifi — Founder, The DevArt
Eight eMudhra intermediate CA keys were compromised — attackers could impersonate any site while browsers showed a padlock. What online store owners should actually do.
TL;DR — Last week the private keys of 8 intermediate CA certificates from eMudhra leaked; an attacker could impersonate any website and browsers still showed a padlock. The lesson for online stores: HTTPS is part of your trust promise, not a set-and-forget checkbox.
What happened, in plain English
Certificate Authorities (CAs) must guard their private keys like house keys. A report published October 20, 2026 showed the private keys of eight eMudhra intermediate CA certificates were mis-generated — meaning anyone could recover them from the certificates themselves, and this had been possible since April 2025.
The practical result: anyone on the network path (say, a public Wi-Fi) could issue a valid-looking certificate for github.com or your store's domain, and browsers would show the secure padlock. The reporter proved it by signing a message with each compromised key and disclosed it to the root programs on October 17.
Responses were fast but uneven: Firefox and Chrome blocked the certificates from October 17, Microsoft from October 20, Apple products from October 22. But many other clients — apps that ship their own CA bundle — needed separate updates. According to the researcher's site, even macOS 27.2 (October 26) still shipped developer tools like git and curl that trusted the compromised certificates.
Why this is your problem, not just the hackers'
Your store lives on three things: traffic, carts, and trust. Man-in-the-middle attacks hit all three:
- Fake checkout pages: a customer on café Wi-Fi sees your store, but what actually runs is the attacker's page. Right URL, padlock and all.
- Tampered downloads: catalogs, invoices, or your own apps travel the same interceptable path.
- Brand damage: customers don't know what a CA is; they just know "I bought from your site and my money vanished."
The sharper point: browsers recovered quickly, but desktop apps — especially Electron-based ones like Slack and Discord — stayed vulnerable until their own updates shipped. If you ship an app, its bundled CA store deserves real attention.
The store checklist
- [x] Confirm your SSL certificate is from a reputable CA with auto-renewal on — but know that isn't enough; this incident was the CA's failure, not yours.
- [ ] Keep browsers and test devices updated; Firefox/Chrome patched from Oct 17, Apple from Oct 22.
- [ ] If you ship a desktop or webview app, verify its networking engine (Electron or CA bundle library) is a patched version.
- [ ] Use a reputable payment gateway instead of direct card forms — a second line of defense against spoofed pages.
- [ ] Tell customers the official domain in writing: "only buy from X." When spoofing waves hit, this sentence is gold.
- [ ] Review payment gateway logs weekly; odd transactions surface early.
So is HTTPS pointless now?
The opposite. The web trust system worked: the intermediates were never logged to Certificate Transparency, so CT-enforcing browsers (Firefox, Chrome, Edge, Safari) could not be silently attacked, and root programs reacted within days. The weak layer was clients with no revocation mechanism — which is exactly why keeping software updated matters more than ever.
For your store: HTTPS is necessary but not "set and forget." Like the lock on your shop door — good lock, but check it now and then.
| Layer | What it protects | Who owns it | | --- | --- | --- | | Site SSL certificate | Encrypts the customer connection | You (buy + renew) | | Reputable CA | Attests domain identity | You + browsers | | Updated browser / OS | Blocks compromised certificates | Customer (you remind them) | | Payment gateway | Keeps card data out of your hands | The gateway |
FAQ
Q: Does the padlock mean my site is safe?
For the customer-to-site connection, yes — encryption is active. But incidents like eMudhra show the trust chain itself can break. For a store, layered defenses (reputable gateway, updated clients) are part of security too.
Q: I run a store — what should I do right now?
No emergency action for typical WordPress/Shopify setups — browsers patched themselves. Your job: verify auto-renewal, ship patched app versions if you have an app, and tell customers your official domain.
Q: Does this affect SEO?
Not directly. Google treats HTTPS as a ranking signal and your site is fine. The risk is indirect: if your brand gets linked to a spoofing incident, the trust that drives click-through and conversion takes the hit.