Indian certificate authority eMudhra used fatally weak private keys that were compromised, creating a global trust problem for websites and services using its certificates. Mozilla said eight eMudhra intermediate certificate keys were compromised, allowing fraudulent HTTPS certificates for any domain; browsers and platform vendors including Mozilla, Google Chrome, and Apple moved to distrust the affected certificates, while eMudhra revoked them. Researchers said some recovered private keys were trivially guessable values such as 4, 56, and 115.
Why it matters: This is urgent because forged certificates can let attackers convincingly impersonate websites and intercept or alter traffic if systems still trust the affected chain. Organizations should immediately inventory and replace any eMudhra-issued certificates, update browsers and trust stores, and verify internal services are not relying on the distrusted intermediates.
Lawrence Abrams
2026.10.21
95% relevant
This article updates the same eMudhra compromised-certificate incident with specific downstream mitigations: Mozilla, Google, and Apple trust-store blocks, Firefox 158.0.1 and ESR releases, and remediation status for Go, Linux distributions, NSS, curl bundles, Python certifi, Rust webpki roots, Electron, and other software.
2026.10.20
100% relevant
This article establishes a new tracked event centered on eMudhra's compromised intermediate certificate private keys and the resulting industry-wide certificate distrust and replacement effort.
← Back to all stories