SKN | Tech Giants Block Eight eMudhra Certificates After Critical Private-Key Flaw

Key Points:

• Certificate Security Compromised: Eight intermediate certificates issued by India-based certificate authority eMudhra contained a private-key generation flaw that made their keys relatively easy to recover.
• Major Technology Companies Respond: Mozilla, Google, Apple, Microsoft and Cloudflare implemented blocks or other mitigations across their respective platforms and services.
• Broader Exposure Remains Uncertain: No evidence of attacks through the major browsers was reported, but the potential impact on applications that do not automatically receive certificate revocation updates remains unknown.

Private-Key Flaw Triggers Emergency Certificate Blocks

Major technology companies have moved to block eight vulnerable intermediate digital certificates issued by eMudhra Limited after researchers identified a flaw that could allow attackers to impersonate legitimate websites.

The incident centers on the generation of private keys used to secure digital certificates. According to Mozilla cryptography engineer Dennis Jackson, the key-generation process was sufficiently flawed that Mozilla independently recovered the private keys after receiving notice of the problem on Saturday. He described the vulnerability as trivial to exploit.

Digital certificates help browsers and other applications verify website identities and establish encrypted HTTPS connections. If an attacker obtains the private key associated with a trusted certificate, fraudulent certificates could potentially be used to impersonate legitimate websites. Depending on the circumstances, this could enable interception or manipulation of information exchanged with affected systems.

The vulnerability therefore extends beyond the integrity of individual certificates. It raises questions about how quickly trust can be withdrawn when the cryptographic foundations supporting website authentication are found to be unreliable.

Browser Developers and Infrastructure Providers Respond

Mozilla said its security team received the report on Saturday and blocked the affected certificates in Firefox through OneCRL, its mechanism for distributing certificate revocation information. The initial blocking action was completed that day.

Mozilla subsequently released a Firefox update for desktop and Android devices to protect users with custom configurations that might prevent them from receiving the OneCRL update automatically.

Cloudflare said it became aware of the report on Monday and deployed updates to Cloudflare One, WARP Clients and Cloudflare Tunnel on Tuesday. The company also introduced mitigations across its services.

Jackson reported that the affected certificates had been blocked in Chrome from Saturday, on Apple devices from Monday and across Microsoft platforms from Tuesday.

The coordinated response demonstrates the role of browser vendors, operating-system providers and infrastructure companies in maintaining the web’s certificate trust system. However, distributing protections across different products and configurations can take time, particularly where certificate validation is handled outside standard browser environments.

Uncertainty Surrounds Potential Exploitation

Despite the rapid response, the extent of possible exposure remains uncertain.

Jackson said there was no evidence that Firefox, Chrome, Edge or Safari had been attacked using the vulnerable certificates. He pointed to the absence of entries involving the intermediate certificates in certificate transparency logs since April 2025.

Certificate Transparency provides a public record of issued certificates, helping security researchers and website operators identify suspicious certificate activity. However, it does not provide universal visibility into every possible attack involving compromised cryptographic material.

Jackson cautioned that many clients outside the browser ecosystem do not enforce Certificate Transparency. Researchers therefore could not determine whether attackers had exploited the weak key generation to target those systems.

Applications that do not automatically receive certificate-blocking updates may remain exposed until their operators implement the relevant protections. Organizations using affected trust stores or certificate-validation configurations may need to verify that the blocks are active rather than assume that browser-level mitigations cover their entire technology environment.

Lessons From the DigiNotar Breach

The incident recalls the 2011 compromise of DigiNotar, a Dutch certificate authority whose systems were breached and used to issue 531 fraudulent SSL certificates.

Those certificates enabled attackers to impersonate trusted services, including Google, and spy on approximately 300,000 Iranian Gmail accounts.

Although the circumstances differ, both incidents illustrate how weaknesses in the certificate authority ecosystem can undermine trust beyond the organization directly affected. Certificate authorities occupy a critical position because their credentials can be relied upon by browsers and other software to establish the identity of online services.

The eMudhra incident also highlights the distinction between identifying a cryptographic weakness and establishing whether it has been exploited. Rapid revocation can limit future exposure, but it does not by itself determine whether credentials were misused before the blocks took effect.

Outlook

The immediate priority is ensuring that the eight affected certificates are rejected consistently across browsers, operating systems, enterprise infrastructure and other applications that rely on certificate validation. The absence of detected attacks in major browsers is reassuring, but it does not establish that exploitation did not occur elsewhere. Further clarity will depend on continued monitoring, the implementation of protections outside the browser ecosystem and any additional evidence about how the flawed private keys may have been used.