Apple, Google and Mozilla have blocked eight digital certificates associated with Indian cybersecurity and digital trust company eMudhra as researchers discovered a serious weakness in their cryptographic keys. The flaw could have allowed attackers to create fraudulent certificates and impersonate legitimate websites or online services.
That has led to urgent action on major browsers and software platforms to prevent the compromised certificates from being trusted. The compromised certificates were connected to eMudhra's intermediate certificate authorities that play an important role in verifying the identity of websites.
While this raised concerns for internet security, Google said its Certificate Transparency checks found no evidence that certificates issued through the six affected intermediates used for website security had been publicly logged before the blocks took effect.
eMudhra also said its investigation showed that the affected intermediate authorities had not issued end-entity certificates. The company said that only one of the affected intermediates had been deployed in production, and that it had not issued such certificates either.
What is the eMudhra Security Certificate issue?
The problem is eight intermediate certificate authority certificates associated with eMudhra. Their private cryptographic keys were found to be dangerously weak, so they were able to recover them far more easily than a properly generated key should allow.
Digital certificates are useful for web browser visitors to check if a website is what it claims to be. It is indeed HTTPS, the technology that encrypts information sent between a user's browser and a website.
Certificate authorities issue and manage these credentials. Intermediate certificates are between a trusted root certificate and the certificates issued to individual websites or services.
If an attacker has access to an intermediate certificate's private key, they may be able to create fake website certificates that look legitimate to systems that still trust the compromised authority.
In the eMudhra case, the weakness was related to insufficient randomness when generating the keys. The affected keys had values that could be recovered by testing a very small number of possibilities rather than the enormous range expected for secure cryptographic keys.
This made the problem much more serious than an ordinary software bug because it affected a component of the system used to establish trust across the internet.
How were the Weak Keys discovered?
A security researcher alerted major technology companies on October 17, 2026, of the problem. The researcher showed that the private keys associated with the eight intermediate certificates could be recovered.
Mozilla independently confirmed the weakness after receiving the report. Google and Apple also verified the findings and started taking steps to block the affected certificates.
The incident showed how weak key generation can undermine otherwise trusted digital security infrastructure. And even if browsers and operating systems follow established certificate verification procedures, those protections can fail if the underlying cryptographic keys are not generated securely.
The discovery caused eMudhra and software vendors to respond to revoke the affected certificates and add additional safeguards.
Why did Apple, Google and Mozilla block the Certificates?
The blocks are to prevent browsers and other software from accepting certificates that use the compromised keys.
If a vulnerable intermediate certificate was still trusted, an attacker with its private key could create a fraudulent certificate for a legitimate website. Under certain circumstances, that could enable the attacker to impersonate the website, or to intercept or modify communications.
Google said Chrome blocked the affected certificate keys through its certificate-revocation protections. The company also extended protections to Android devices through Google Play Services.
Mozilla blocked the certificates in Firefox through its centralized certificate-blocking system. It also released Firefox updates for users whose custom configurations might prevent them from getting the automatic protections.
Apple introduced protections against the affected certificates as part of its response to the incident.
The Go programming language project also released security updates for applications that use its certificate-verification mechanisms. The maintainers recommended upgrading to patched versions 1.27.3 or 1.26.10.
These are meant to protect vulnerable certificates from being trusted, but protection can differ among different software. Some software applications store their certificates in their own certificate store and are not automatically updated and need separate patches to support revocation.
Were the Certificates exploited by hackers?
As of the latest public updates, there was no evidence in Certificate Transparency logs that the six affected intermediate certificates used for website TLS security had issued publicly logged certificates before Google blocked them.
Certificate Transparency is a system that records the issuance of publicly trusted website certificates.
Google said its checks found no evidence of certificates issued through the affected intermediates in those logs prior to the blocking action. This was an important safeguard because Chrome requires Certificate Transparency for publicly trusted certificates by default.
But the absence of evidence in those logs does not mean that each and every possible way of misuse was impossible. The investigation also raised questions about how the keys became vulnerable and whether other software that does not receive browser protections could be exposed as well.
eMudhra added that it was investigating the incident and has taken steps to contain the affected certificates. The company also said the issue was limited to the specific intermediate certificates involved and was not affecting its root certificate authority private keys or other intermediate authorities.
What does this mean for the Internet users?
In the case of most users who use modern browsers with a high level of security, the blocks that technology firms make are designed to protect them without needing them to manually find and remove the compromised certificates.
Firefox users with standard configurations received the relevant blocking update without needing to restart or update the browser. Google also distributed protections through Chrome and Google Play Services.
For older devices, specialized applications, embedded systems and software that manages its own certificate trust may need separate updates. This is one reason why resolving a certificate authority incident can take longer than fixing a flaw in a single browser.
Consumers should keep their browsers, operating systems and application settings updated and not ignore genuine security warnings. A website that has a certificate error on its name is not safe just because the address is familiar from the start of the website is not safe and so is the same as an unusual certificate error.
The incident does not mean that all eMudhra-issued certificates or every website using HTTPS are automatically unsafe. The response focuses on the affected certificates and the systems that continue to trust them.
What happens next for eMudhra?
The incident has raised questions about the security controls used in certificate generation and the processes certificate authorities follow to protect their private keys. eMudhra is reviewing the situation and has said it is reviewing its security controls and operational processes. The company also is working with browser developers and other parties in the internet's certificate trust system, said a company representative.
Google said it was reviewing eMudhra's remaining certificates in its Chrome Root Store. It also announced plans to remove the emSign ECC Root CA - G3 root certificate from the Chrome Root Store and the change is expected to be available for general use around October 27, 2026, Pacific time.
That removal could cause some legitimate certificates associated with the root to stop working in Chrome. Website operators affected by the change have been advised to apply for replacement TLS certificates from another supported certificate hierarchy.
The bigger problem is that all software and devices that depend on affected certificate authorities need to stop trusting vulnerable credentials. While the major browsers can deploy protections quickly, systems that do not automatically receive those updates may need work as well.
The eMudhra incident illustrates the need for strong cryptographic key generation and effective oversight of the certificate authorities that make up internet security. Although large companies have made some efforts to curb the immediate threat, the full remediation of affected systems will depend on how quickly affected systems receive the necessary protections.
Comments
Leave a Comment