Mozilla, Google, Apple and Microsoft block eight eMudhra intermediate certificates after their private keys proved recoverable almost instantly

TLDR

• Eight intermediate certificates from Indian certificate authority eMudhra used private keys so weak they could be recovered almost instantly.¹²
• Mozilla and Google blocked them on 17 October, Apple on 19 October and Microsoft on 20 October; eMudhra revoked them.¹³
• Software without revocation checks may keep trusting them; sources report no evidence the keys were abused.¹³

BleepingComputer, Help Net Security and SecurityWeek report that eight intermediate certificates issued by the Indian certificate authority eMudhra were backed by private keys that anyone could recover from the public certificates, which would let an attacker forge certificates that browsers and operating systems trust for any website.¹²³ According to BleepingComputer, which cites Mozilla's incident report, all eight used P-384 keys generated in April 2025 whose values were smaller than 256, so they could be found by testing 256 numbers.¹ A security researcher known as Wayne found the problem on 17 October while scanning Common CA Database data, and Help Net Security says he reported it to Apple, Google, Microsoft, Mozilla and eMudhra.¹² Security researcher Scott Helme said he recovered keys with values of 4, 56 and 115 on his laptop in under a second, and BleepingComputer independently verified that a key published on GitHub, with a value of 4, matches one of the revoked certificates.¹² Mozilla's Dennis Jackson described the keys as effectively all zeroes apart from the last byte and said several people had independently recovered them.³

Help Net Security says the eight came from a batch of 24 intermediates eMudhra generated on 30 April 2025, that six issue website TLS certificates and two are used for code signing, and that Sectigo cross-signed all eight in May 2025.² BleepingComputer says only some of the resulting certificates were submitted to Sectigo for cross-signing.¹ eMudhra told Mozilla that a flaw in a script used in the April 2025 key ceremony created a second set of weaker keys, which staff picked by mistake because their labels resembled those of the properly generated ones.¹²³ eMudhra said the certificates were meant for export to its US and European data centres and, according to SecurityWeek, that one of them was ever used in production.³ BleepingComputer reports that most were never used in production and that the company found no evidence they issued certificates to end users, while Help Net Security reports the company's position as that none issued customer certificates.¹² eMudhra has said it will re-verify every key ceremony it has carried out.²³

Mozilla blocked the certificates through Firefox's OneCRL system on 17 October, and BleepingComputer says Google Chrome blocked the six that can issue TLS certificates the same day, with Apple adding protections on 19 October.¹ Help Net Security and SecurityWeek give Microsoft's block as 20 October, and Help Net Security says eMudhra revoked the certificates on 18 October.²³ Mozilla released Firefox 158.0.1 and updates for its ESR releases on 20 October for users whose configurations had not received the earlier revocation, and the Go team released versions 1.27.3 and 1.26.10 for the issue, tracked as CVE-2026-111943, according to BleepingComputer.¹ Help Net Security adds that Mozilla has since removed trust in the eMudhra root that signed the intermediates, that Google says it will do the same in Chrome while it evaluates eMudhra's remaining CA certificate, and that eMudhra estimates about 30,000 customer certificates need to be replaced.²

SecurityWeek says Certificate Transparency logs show no sign that the keys were used maliciously before revocation, but not all clients enforce Certificate Transparency.³ Help Net Security says it is not known whether anyone recovered and used the keys in the 17 months before the report.²

Why it matters: the certificates chained to roots trusted by Apple, Google, Microsoft and Mozilla, and the main remaining risk is software, servers and devices that use their own certificate stores or never learn of revocations: Jackson warned that macOS's built-in curl may still trust the certificates, and administrators are advised to update their certificate bundles and use the advisory's test endpoints.¹²