Google and Mozilla Revoke eMudhra Certificates After Private Key Flaw
Major browsers block eight eMudhra intermediates after researchers prove weak entropy allows trivial key recovery and potential impersonation.
Key points
- Google and Mozilla revoked eight eMudhra intermediate certificates due to compromised private keys.
- Mozilla independently recovered the keys, confirming the generation process was trivial to exploit.
- Six certificates were for TLS encryption while two were intended for code signing.
Google and Mozilla have revoked eight intermediate certificate authorities operated by Indian digital trust provider eMudhra after determining their private keys were compromised. This action follows a report from a researcher identified as Wayne, which indicated that attackers could forge trusted certificates to impersonate websites.
Mozilla received the alert on October 17 at 20:06 UTC via its security mailing list, forwarded by the Chrome Root Program. Dennis Jackson, a Mozilla engineer, stated that an attacker with these keys could impersonate any website or service. Mozilla subsequently began blocking the affected certificates in Firefox browsers to mitigate the risk.
Technical Analysis of the Flaw
Mozilla independently recovered the private keys for the impacted certificates at 21:48 UTC on the same day, without knowing the original reporter's method. Jackson noted this recovery confirmed the key generation process was flawed and trivial to exploit. The company stated the keys were generated with insufficient randomness, enabling weak cryptographic entropy.
Security researcher Scott Helme analyzed the issue, revealing that one of the private keys was simply the number four. He reported two other keys had values of 56 and 115. Helme said he recovered all eight keys from their public certificates in less than a second, demonstrating the ease of exploitation.
Scope and Vendor Response
Six of the eight affected intermediate certificates were intended for Transport Layer Security, which browsers use to authenticate websites and establish encrypted connections. The remaining two certificates were designated for code signing purposes. Google deployed a Chrome Revocation List Set update to block these intermediate authorities, according to its security blog.
eMudhra acknowledged the report and stated it was investigating the incident, according to the Mozilla bug report. This event follows earlier trust concerns, as Threat Times reported in October 2026 that major browsers blocked eight eMudhra certificates after a researcher demonstrated control over their private keys.
What should you do?
Organizations should verify if they hold certificates issued by the affected eMudhra intermediates and replace them with certificates from trusted authorities. Security teams should monitor browser logs for revocation warnings related to these specific certificate serial numbers. Users should ensure their browsers are updated to receive the latest revocation lists.
What to do and how to stay safe: eMudhra
- Check your internal certificate inventory for any issuers matching the revoked eMudhra intermediate authorities.
- Update your web browsers and operating systems to apply the latest revocation list sets from Google and Mozilla.
- Monitor server logs for failed handshake attempts or warnings related to weak cryptographic entropy or revoked intermediates.
- Contact your certificate provider to confirm whether any of your existing certificates were signed by the compromised keys.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why were the eMudhra certificates revoked?
The certificates were revoked because their private keys were compromised due to a flawed generation process with insufficient randomness.
How many certificates were affected?
Eight intermediate certificate authorities operated by eMudhra were affected, six for TLS and two for code signing.
Did Mozilla confirm the vulnerability independently?
Yes, Mozilla independently recovered the private keys later on October 17, confirming the keys were vulnerable and trivial to exploit.
