Google, Apple, Mozilla rush to block compromised eMudhra certificates

Google, Apple, and Mozilla have blocked compromised eMudhra certificate authority certificates after researchers found that their private keys could be recovered almost instantly, potentially allowing attackers to impersonate websites.

The failure has also prompted Mozilla and Chrome to move toward distrusting eMudhra’s emSign ECC Root CA – G3, with the company estimating that approximately 30,000 certificates require migration.

A researcher known as Wayne discovered the problem on October 17 while examining certificates in the Common CA Database. He demonstrated control of all eight keys by signing a message with each and notified eMudhra and the major browser root programs.

eMudhra operates the emSign certificate authority service, whose certificates establish trust in websites and software. Six affected intermediates were intended for TLS certificates and chained to roots trusted across major browsers, while two were for code signing and trusted by Microsoft.

Private keys reduced to tiny numbers

Mozilla’s Dennis Jackson independently recovered the keys and documented the failure in the public incident report. All eight were P-384 elliptic curve keys generated on April 30, 2025, but their private values were integers below 256, making recovery nearly instantaneous.

An attacker controlling a TLS intermediate’s key could issue certificates for domains they do not own. If able to intercept a vulnerable client’s connection, they could impersonate a website and potentially read or alter its traffic.

According to eMudhra’s preliminary investigation, a script flaw during a key generation ceremony involving Utimaco hardware security modules created weak keys alongside correctly generated ones. Similar key labels led staff to use the weak keys in certificate signing requests, including requests sent to Sectigo for cross-signing.

The company also acknowledged that earlier certificate revocation lists were initially signed with the correct keys, producing invalid signatures because the certificates contained the weak public keys. Staff subsequently re-signed those lists using the flawed keys.

eMudhra said its assessment indicated RSA issuers followed a different code path and were unaffected. Its investigation remains ongoing.

Browsers protected, wider ecosystem updating

Mozilla blocked the intermediates through OneCRL by 22:59 UTC on October 17, less than three hours after receiving the report, without requiring Firefox updates or restarts. It subsequently released Firefox 158.0.1 and ESR versions 115.43.1 and 153.5.1 to cover users whose settings prevented automatic delivery.

Apple blocked the compromised intermediates on October 19, followed by Microsoft on October 20, according to the incident disclosure page. Chrome had already blocked them on October 17, the same day Mozilla deployed its Firefox protections. Both eMudhra and Sectigo have also revoked the affected certificates.

However, applications that do not check revocation information require separate updates. Mozilla is removing the G3 root through NSS 3.131.1, and eMudhra has stopped issuance beneath it while arranging subscriber migration.

The disclosure page reports no corresponding Certificate Transparency log entries indicating fraudulent issuance, but exploitation against clients without CT enforcement remains unknown.

Users should update browsers, operating systems, and certificate packages. Developers should also update affected runtimes and dependencies: Go 1.27.3 and 1.26.10 block the intermediates under CVE-2026-111943. Administrators can consult the incident page for package versions and client tests, including caveats for macOS’s built-in curl.