Science & Tech · Cybersecurity · 1 hr ago
Weak eMudhra certificate keys prompt browser and software blocks
Researchers found eight eMudhra intermediate certificates had easily recoverable private keys in certificates created in April 2025.
eMudhra, an India-based digital trust company, operates a certificate authority that helps confirm websites are genuine.
The weakness meant someone could potentially use the keys to create trusted certificates and impersonate websites or intercept encrypted traffic.
eMudhra said a script error created weak keys that were mistakenly selected, and said the affected certificates had not been used to issue certificates to end users.
No evidence of real-world misuse has been reported, though the keys may have been exposed since their creation.
Mozilla, Google, Apple and other companies blocked the certificates, and eMudhra revoked them and stopped issuing certificates under the affected root.
Users and administrators should install available software updates, because some non-browser programs may continue to trust the certificates until updated.
Eight eMudhra intermediate certificate keys were weak enough to be recovered almost instantly, potentially allowing attackers to forge trusted certificates for websites or software.
eMudhra revoked the eight certificates after a researcher reported the problem on October 17.
Google, Mozilla, Apple and other providers blocked affected certificates, while some applications require software updates to stop trusting them.
eMudhra said the weakness came from an error in a certificate-generation script used in April 2025.
The sources report no confirmed abuse, but say it remains unclear whether anyone used the keys to issue fraudulent certificates.
- Who
- eMudhra, an Indian certificate authority, and browser and software providers responding to the compromised keys.
- What
- Eight intermediate certificate keys were weak and could be recovered, potentially enabling forged certificates. Providers blocked them or issued software fixes.
- When
- A researcher reported the issue on October 17, 2026; blocks and updates followed over the next several days.
- Where
- The affected certificates were issued by eMudhra; the risk applies to browsers and other software worldwide.
- Why
- An error in a script used to generate certificates in April 2025 produced weak keys that were mistakenly selected for signing.
This story does not have two clearly opposing sides.
eMudhra generated the weak keys while creating certificates, according to the company.
Researcher Wayne reported the compromised keys to browser and software root programs.
Google and Mozilla blocked affected TLS certificates through revocation mechanisms.
eMudhra revoked the eight certificates, according to ITmedia.
Apple blocked the certificates, and Sectigo completed revocation of cross-signed certificates, according to ITmedia.
Mozilla released Firefox updates for users who did not receive earlier revocation updates; Go also released patched versions.
- Affected certificates
- Eight eMudhra intermediate certificates: six for TLS and two for code signing
- Weak key values
- All eight P-384 private keys had values smaller than 256
- Researcher report
- Wayne reported the issue on October 17, 2026
- eMudhra cause
- A script error during certificate generation in April 2025
- Go fixes
- Versions 1.27.3 and 1.26.10
- CVE identifier
- CVE-2026-111943
5 sources
Mozilla, Google, Apple block compromised eMudhra CA certificates
認証局eMudhraの中間証明書、秘密鍵が「数ミリ秒」で復元可能な脆弱性 大手各社が緊急遮断
Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
What people are saying
However, many other clients do not consume revocation information and require software updates to ensure they no longer trust the compromised intermediates.
highly recommend