Major Technology Companies Scramble to Revoke 8 Compromised eMudhra Certificates
Security vulnerability in private key creation enabled potential attackers to predict keys and create fraudulent HTTPS certificates for any domain.
Major technology corporations have implemented urgent countermeasures to block eight compromised digital certificates that posed a significant risk of enabling malicious actors to masquerade as authentic websites.
As of Tuesday, developers of web browsers and additional leading tech organizations had rolled out defensive measures against eight intermediate certificates that were issued by eMudhra Limited, a certificate authority based in India, following the discovery that their private keys lacked adequate security protections.
In an incident report, Dennis Jackson, a cryptography engineer at Mozilla, documented that Mozilla was able to independently retrieve the private keys upon receiving initial notification of the security flaw on Saturday, verifying that the process used for key-generation was both "flawed" and "trivial to exploit."
According to Mozilla's assessment, a malicious actor intercepting a user's network connection could leverage these fraudulent certificates to pose as an authentic website and potentially intercept or modify the data being transmitted.
Despite numerous companies swiftly implementing blocks for the compromised certificates, the security risk persists for applications and computing systems that do not automatically receive such blocking updates.
Mozilla Firefox's security division stated in a Tuesday blog post that they received the initial report on Saturday and took immediate action by blocking the compromised certificates in Firefox through OneCRL, completing this protective measure within the same day. Subsequently, they deployed an update for their browser on both Desktop and Android platforms, safeguarding users whose custom configurations had prevented them from receiving the OneCRL update.
Cloudflare disclosed that it was notified of the report on Monday and proceeded to release patches for its Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, in addition to implementing protective measures throughout its service infrastructure.
According to Jackson's report, the compromised certificates have been successfully blocked in Chrome starting from Saturday, across Apple devices beginning Monday, and on Microsoft platforms as of Tuesday.
The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates.
Jackson indicated that there is no indication that Firefox, Chrome, Edge and Safari users have been compromised through this vulnerability, as no entries related to the intermediate certificates appeared in the certificate transparency logs since April 2025.
However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients.
This security incident brings to mind the 2011 compromise of DigiNotar, a significant cyber incident in which attackers breached the Dutch certificate authority, resulting in the issuance of 531 illegitimate SSL certificates.
These unauthorized certificates enabled malicious actors to impersonate Google and conduct surveillance on roughly 300,000 Iranian Gmail users.