Browsers Block Eight eMudhra Certificates After Researcher Proves Key Compromise
Major browser vendors blocked eight eMudhra intermediate certificates after a researcher demonstrated control of their private keys, raising concerns about forged SSL trust.
Key points
- Eight eMudhra intermediate CA private keys were compromised, as proven by a researcher named Wayne.
- Mozilla, Chrome, Apple, and Microsoft blocked the certificates between October 17 and October 20, 2026.
- The compromise allows for potential forgery of TLS certificates that clients may trust.
Major web browsers and software platforms blocked eight intermediate certificates from eMudhra after a researcher proved control of their private keys. The emergency action followed a report on October 17, 2026, which demonstrated that the keys could sign arbitrary data, threatening the integrity of secure web connections. This event follows earlier reporting by Threat Times on October 20, 2026, regarding the global browser blocks triggered by the compromise.
The affected certificates chain to root authorities trusted by Mozilla, Microsoft, Apple, and Google Chrome. According to Cyber Security News, clients that still accept these certificates remain at risk of trusting forged identities. The researcher, identified as Wayne, reported the issue to root program teams and signed a test message using each compromised key. This proof-of-concept confirmed signing capability without releasing the private keys themselves.
Technical Verification and Timeline
Wayne submitted the findings to root program teams on October 17, 2026. To verify the claim, researchers can use OpenSSL to extract public keys from the certificates provided on the disclosure site and check the signatures. The disclosure site, published by Dennis Jackson, hosts the necessary data for independent validation. This method allows the community to confirm access without exposing sensitive cryptographic material to the public.
Mozilla received the report at 20:06 UTC on October 17 and finalized its OneCRL blocklist rollout by 22:59 UTC that same day. Standard Firefox configurations received protection automatically, according to Mozilla’s incident statement. Chrome also blocked the certificates on October 17. Apple followed with its own protections on October 19, while Microsoft’s mitigation arrived on October 20, as noted by Cyber Security News.
Trust Chain Implications
An intermediate certificate authority serves as a bridge between a website’s leaf certificate and a trusted root. If its signing key is exposed, an attacker can generate fraudulent certificates that vulnerable clients may accept as genuine. Mozilla warned that an interceptor could use these forged certificates to impersonate websites. This could allow an attacker to read or modify traffic in transit, undermining the confidentiality and integrity of HTTPS connections.
The public disclosures do not establish that these keys can be cracked in seconds. Instead, they confirm that a researcher demonstrated control of the keys, without specifying how they were obtained or how quickly a cryptographic attack could recover them. The risk echoes earlier reporting on unauthorized HTTPS certificates obtained through compromised domain registries and misissued TLS certificates affecting the 1.1.1.1 DNS service, according to Cyber Security News. Those cases involved different failures but highlight why certificate trust remains a critical security concern beyond the browser padlock.
What should you do?
eMudhra has revoked the compromised intermediate certificates, but revocation alone does not protect every application. Some systems may not check revocation lists or may cache certificates for extended periods. Organizations should verify that their browsers and software have received the latest updates from Mozilla, Chrome, Apple, and Microsoft. Monitoring for any new disclosures regarding the scope of the compromise is also advisable, as the method of key exposure remains unclear.
What to do and how to stay safe: eMudhra
- Verify that all browsers and operating systems have applied the latest security updates to block the compromised certificates.
- Check internal systems and applications that handle TLS traffic to ensure they are configured to respect revocation lists.
- Monitor for further disclosures regarding the scope of the compromise and any additional affected certificates.
- Review logs for any unusual certificate usage or connection attempts during the period before the blocks were implemented.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which certificates were compromised?
Eight intermediate certificate authority certificates from eMudhra were compromised, as proven by a researcher demonstrating control of their private keys.
When did the browsers block these certificates?
Mozilla and Chrome blocked them on October 17, 2026, Apple on October 19, and Microsoft on October 20, 2026.
Is there a fix available?
Yes, major browser vendors have released blocks for the affected certificates, and eMudhra has revoked them.
