Mozilla, Google, and Apple Block Vulnerable eMudhra Certificates
Eight compromised certificates were revoked after researchers identified a critical flaw in the key generation process.
A significant security incident has emerged in the web infrastructure sector: certificate authority eMudhra has been forced to revoke eight intermediate certificates following the discovery of a critical vulnerability. The flaw was severe enough that private keys could be recovered almost instantly, potentially allowing attackers to forge digital signatures for trusted websites.
What really happened?
Security researchers determined that P-384 private keys generated in April 2025 were mathematically extremely weak. Their values were less than 256, meaning anyone could guess the key in just 256 attempts. A researcher operating under the pseudonym Flüpke publicly demonstrated the vulnerability on GitHub by publishing a key with a value of just 4, proving the system was entirely insecure.
eMudhra stated that the issue stemmed from a technical error in the script used to generate certificates. The company explained that the glitch resulted in a set of weak keys being incorrectly selected for certificate validation. While eMudhra asserts that most of the vulnerable certificates were never used in a live environment and there is no evidence of exploitation, the potential risk had existed since April 2025.
Who is protected?
Mozilla, Google, and Apple responded quickly. Mozilla blocked the vulnerable certificates via Firefox’s OneCRL system on 17 October, protecting users without requiring additional updates. Google Chrome blocked the six most dangerous intermediate certificates on the same day, while Apple implemented its protection mechanisms on 19 October.
However, the issue may affect software that uses its own certificate store or fails to check certificate revocation status. For example, the Go development team has already released updates to address the CVE-2026-111943 vulnerability. Additionally, the macOS built-in /usr/bin/curl utility remains a concern, as it may still trust the compromised certificates.
What does this mean for users?
If you use modern web browsers such as Firefox or Chrome, you are largely protected as they have already received automatic updates. However, system administrators and developers managing server infrastructure must verify their systems. Mozilla cryptography engineer Dennis Jackson has published a dedicated page listing affected software and the corresponding security updates.
Ultimately, this incident serves as a reminder of how critical transparency and technical accuracy are for certificate authorities. Even a minor error in cryptographic generation can compromise the entire chain of web security. It is recommended to ensure that all workstations and servers are updated to the latest versions.