Mozilla, Chrome, Apple and Microsoft Block Eight Flawed eMudhra Certificates
Eight eMudhra certificates blocked after key flaw
Major browser makers and technology companies have moved to block eight digital certificates that were issued by India-based certificate authority eMudhra Limited. The certificates had private keys that were not secure enough, which could have let attackers create fake versions of real websites.
A certificate authority is an organization that issues the digital certificates websites use to prove their identity. If a certificate can be forged, an attacker who sits between a user and a website may be able to read or change the information they exchange, according to Mozilla.
Mozilla cryptography engineer Dennis Jackson said in an incident report that Mozilla recovered the private keys by itself after first learning about the flaw on Saturday. He described the key-generation process as flawed and trivial to exploit.
Key dates and details
- The flaw was reported on Saturday and responsibly disclosed to downstream trust stores on 19 October, according to Jackson.
- Mozilla said it blocked the affected certificates in Firefox the same day it received the report, using a system called OneCRL, and then shipped an update for Firefox on Desktop and Android for users with custom settings.
- Jackson said the certificates have been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.
- Cloudflare said it learned of the report on Monday and released updates for Cloudflare One, WARP Clients and Cloudflare Tunnel on Tuesday, along with mitigations across its services.
What Mozilla and Cloudflare say
In a blog post on Tuesday, Mozilla Firefox's security team said it received the report on Saturday, blocked the certificates in Firefox the same day, and then released a browser update so users with custom settings would also receive the protection.
Cloudflare said it released updates for Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, alongside mitigations across its services.
No sign of attacks inside browsers
Jackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked in this way. He said there were no entries in the certificate transparency logs for the intermediate certificates since April 2025. Certificate transparency logs are public records that let anyone check which certificates have been issued.
He added that many clients outside the browser ecosystem do not enforce Certificate Transparency, and that it is not known whether attackers used the flawed key generation to target those clients.
What is confirmed
- Eight intermediate certificates issued by eMudhra Limited had private keys that were insufficiently secure.
- Mozilla independently recovered the private keys and confirmed the key-generation process was flawed.
- Protections were deployed by Firefox, Chrome, Apple devices, Microsoft platforms and Cloudflare on the days each company reported.
What is still unclear
It is not known whether anyone actually used the flaw to attack systems. Mozilla said there is no evidence of attacks on the four major browsers, but noted that many non-browser clients do not enforce Certificate Transparency, so it cannot say whether those clients were targeted. Not all systems and applications receive these blocks automatically, and according to Mozilla the threat remains for those that do not.
Why this matters
The certificates are part of the system that helps browsers verify that a website is genuine. A forged certificate could let an attacker pretend to be a legitimate site and potentially read or alter data sent between a user and that site. Because blocks do not reach every kind of software automatically, some users and systems may still be exposed.
A reminder of DigiNotar
The incident recalls the 2011 breach of DigiNotar, a major cyberattack in which hackers compromised the Dutch certificate authority and issued 531 fraudulent SSL certificates. Those rogue certificates let attackers pose as Google and spy on roughly 300,000 Iranian Gmail accounts.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.