Tech giants block eight vulnerable eMudhra certificates Linked to impersonation risk

Mozilla discovers private keys were trivial to exploit; browser makers race to deploy patches.

By LineZotpaper

Published21 October 2026

Read Time2 min

Major technology companies including Mozilla, Google, Apple, and Microsoft have moved to block eight digital certificates issued by India-based certificate authority eMudhra Limited after discovering their private keys were trivially exploitable, potentially allowing attackers to impersonate legitimate websites and intercept user communications.

Tech giants have deployed emergency blocks against eight vulnerable digital certificates issued by India-based certificate authority eMudhra Limited. The certificates were found to have insufficiently secure private keys, creating the potential for attackers to impersonate legitimate websites and intercept information.

Mozilla cryptography engineer Dennis Jackson wrote in an incident report that his organisation independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.” An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.

Many companies responded quickly. Mozilla Firefox’s security team blocked the affected certificates in Firefox using OneCRL on the same day it received the report, and released an update for Desktop and Android. Cloudflare became aware of the report on Monday and released updates for its Cloudflare One, WARP Clients, and Cloudflare Tunnel services. Jackson said that the certificates have also been blocked in Chrome since Saturday, on Apple devices since Monday, and on Microsoft platforms since Tuesday.

While the browser ecosystem appears protected, Jackson noted there is no evidence that Firefox, Chrome, Edge, or Safari have been attacked using this method. No entries appeared in the certificate transparency logs for the intermediate certificates since April 2025. However, he warned that “many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients.”

The incident recalls the 2011 breach of Dutch CA DigiNotar, where hackers compromised the authority and issued fraudulent certificates used for targeted surveillance.

Analysis

Why This Matters

The security of encrypted internet traffic depends on the integrity of certificate authorities. A flaw in key generation undermines this trust for millions of users.
The vulnerability exposes users of non-browser software, VPNs, and enterprise systems that do not receive automatic trust store updates, leaving a potential blind spot.
The rapid coordinated response demonstrates the seriousness of the issue and the potential for widespread phishing or eavesdropping.

Background

Certificate Authorities (CAs) are trusted entities that issue digital certificates verifying the identity of websites. If a CA's private keys are compromised, an attacker can forge certificates for any domain, including banks and email providers. The eight eMudhra intermediate certificates were found to have been generated with insufficient security, allowing Mozilla to recover the private keys from the information provided in the initial report. This class of vulnerability undermines a fundamental pillar of internet trust.

Key Perspectives

[Browser Vendors and Security Teams]: Acted swiftly to block the certificates, containing the threat within the browser ecosystem and emphasizing the importance of certificate transparency logs as a defence mechanism. [Enterprise Administrators and Security Professionals]: Face a difficult cleanup task. While browsers are patched, any internal application or device relying on certificate pinning or lacking CT enforcement may remain vulnerable to attack. [The Certificate Authority / eMudhra]: The source material does not include a statement from eMudhra regarding the incident or their key generation practices.

What to Watch

Whether any security researchers report exploitation of the flaw against non-browser clients in the wild.
If major trust stores (Mozilla, Google, Apple, Microsoft) take further action against eMudhra’s root certificates.
The industry response to the broader issue of key generation security among smaller certificate authorities.

Sources

Tech giants rush to block 8 eMudhra certs that could enable fake sites · Cointelegraph.com News

Checked

11 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedTech giants blocked eight eMudhra certificates linked to impersonation risk.Cointelegraph.com News: “By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited”
Partly supportedMozilla discovered that the certificates’ private keys were trivial to exploit.Cointelegraph.com News: “Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.””
Partly supportedMajor technology companies moved to block the certificates after discovering that their private keys were insufficiently secure, creating a risk of impersonation and interception.Cointelegraph.com News: “By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure. An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.”
SupportedAn attacker could use fraudulent certificates to impersonate a legitimate website and potentially read or alter exchanged information.Cointelegraph.com News: “An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.”
SupportedDennis Jackson said Mozilla independently recovered the keys on Saturday and described the key-generation process as “flawed” and “trivial to exploit.”Cointelegraph.com News: “Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.””
Partly supportedCloudflare became aware of the report on Monday and released updates for Cloudflare One, WARP Clients and Cloudflare Tunnel.Cointelegraph.com News: “Cloudflare said it became aware of the report on Monday and released updates for its Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, alongside mitigations across its services.”
SupportedJackson said the certificates had been blocked in Chrome since Saturday, on Apple devices since Monday, and on Microsoft platforms since Tuesday.Cointelegraph.com News: “Jackson said that the certificates have also been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.”
Partly supportedThe browser ecosystem appears protected.Cointelegraph.com News: “Jackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked this way”
SupportedThere were no certificate transparency log entries for the intermediate certificates since April 2025.Cointelegraph.com News: “as there were no entries in the certificate transparency logs for the intermediate certificates since April 2025.”
SupportedJackson warned that many clients outside browsers do not enforce Certificate Transparency and that it was unknown whether attackers exploited the flaw to target them.Cointelegraph.com News: ““However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients,” he said.”
SupportedThe 2011 DigiNotar breach involved hackers compromising the Dutch certificate authority and issuing fraudulent certificates used to spy on Iranian Gmail accounts.Cointelegraph.com News: “The incident recalls a breach of DigiNotar in 2011, a major cyberattack where hackers compromised the Dutch certificate authority, issuing 531 fraudulent SSL certificates. The rogue certificates allowed threat actors to pose as Google and spy on approximately 300,000 Iranian Gmail accounts.”