Major technology companies have deployed emergency blocks against eight vulnerable digital certificates issued by India-based certificate authority eMudhra Limited after a flaw in private key generation made them guessable and opened the door to forged HTTPS certificates for any website.
Mozilla said it recovered the private keys on its own
Mozilla cryptography engineer Dennis Jackson said in an incident report that Mozilla independently recovered the private keys after first receiving notice of the flaw on Saturday. That confirmed the key-generation process was "flawed" and "trivial to exploit."
According to Mozilla, an attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged.
Firefox, Chrome, Apple, Microsoft and Cloudflare rolled out protections
By Tuesday, browser developers and other large technology companies had put protections in place for the eight affected intermediate certificates.
Mozilla Firefox’s security team said in a Tuesday blog post that it received the report on Saturday and blocked the affected certificates in Firefox through OneCRL the same day. Mozilla then released updates for Desktop and Android versions of Firefox to protect users whose custom settings prevented them from receiving the OneCRL update.
Cloudflare said it became aware of the report on Monday. On Tuesday, it released updates for Cloudflare One, WARP Clients and Cloudflare Tunnel, while also applying mitigations across its services.
Jackson said the certificates have been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.
He added: "The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates."
No evidence of browser attacks so far, but risk remains outside the browser ecosystem
Jackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked through this method, noting that there have been no entries in certificate transparency logs for the intermediate certificates since April 2025.
He also warned that the picture is less clear beyond mainstream browsers. "However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients," he said.
Even with rapid action from major vendors, the threat remains for applications and systems that do not automatically receive those blocks.
The case echoes the 2011 DigiNotar breach
The incident recalls the 2011 breach of DigiNotar, the Dutch certificate authority that was compromised in a major cyberattack. Hackers issued 531 fraudulent SSL certificates in that case.
Those rogue certificates allowed threat actors to pose as Google and spy on about 300,000 Iranian Gmail accounts.