Browsers Block eMudhra Certificates After Researcher Proves Key Compromise
Major tech firms blocked eight eMudhra intermediate certificates after a researcher demonstrated control of their private keys, raising concerns about forged SSL trust.
Key points
- Private keys for eight eMudhra intermediate CA certificates were compromised, prompting emergency blocks by Mozilla, Apple, Chrome, and Microsoft.
- Researcher Wayne demonstrated control by signing a message with each key on October 17, 2026, though the method of theft remains unknown.
- The affected certificates chain to roots trusted by major platforms, allowing potential impersonation of websites if clients still accept them.
Major browser and software vendors have blocked eight intermediate certificates from eMudhra after a security researcher demonstrated control of their private keys. The incident, reported on October 17, 2026, triggered emergency response actions across Mozilla, Apple, Google Chrome, and Microsoft to prevent the use of forged digital credentials.
The researcher, identified as Wayne, proved access to the compromised keys by signing the message “We have a problem here – Wayne” with each of the eight intermediate CA private keys. This cryptographic signature confirmed that the keys could be used to issue valid certificates, even though the private keys themselves were not published. The disclosure site, maintained by Dennis Jackson, provides the necessary public keys and signatures for independent verification using tools like OpenSSL.
Context and Background
The compromised certificates are linked to root authorities trusted by Mozilla, Microsoft, Apple, and Chrome. Intermediate certificate authorities serve as a bridge between a trusted root and a specific website’s certificate. When an intermediate key is exposed, an attacker can create fraudulent certificates that vulnerable clients may accept as genuine. Mozilla warned that an attacker intercepting network traffic could use these fake certificates to impersonate websites and potentially read or alter data.
Public disclosures reviewed by Cyber Security News do not support the claim that these keys can be cracked in seconds. The reports confirm that Wayne demonstrated control over the keys, but they do not explain how the keys were obtained or how quickly any cryptographic attack could recover them. The headline from the initial reporting was misleading regarding the speed of potential decryption.
Who Is Affected
Protection measures were rolled out rapidly by major technology firms. Mozilla received the report at 20:06 UTC on October 17 and completed its OneCRL blocklist rollout by 22:59 UTC that same day. Standard Firefox configurations received this protection automatically, without requiring a browser update or restart, according to Mozilla’s incident statement.
Chrome also blocked the affected certificates on October 17. Apple followed suit on October 19, and Microsoft’s protection arrived on October 20. eMudhra has also revoked the compromised intermediate certificates. However, revocation alone does not protect every application, as some software may not check revocation lists or may cache certificates locally.
What should you do?
Security professionals should monitor for any applications that may still trust the revoked eMudhra intermediate certificates. Organizations should verify that their browsers and operating systems are updated to the latest versions to ensure they receive the blocklist updates from vendors. It is also advisable to check internal logs for any unusual certificate validation errors or warnings that might indicate an attempt to use a forged certificate.
What to do and how to stay safe: eMudhra
- Verify that all client devices have received the latest browser and OS updates to include the blocklist for eMudhra’s compromised certificates.
- Monitor network logs for certificate validation errors or warnings that could indicate an attempt to use a fraudulent certificate from this CA.
- Check internal security policies to ensure that applications relying on TLS connections are configured to check certificate revocation lists actively.
- Review any custom or legacy software that may not automatically update its trusted root store, as these systems might still accept the revoked intermediates.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can the compromised eMudhra keys be cracked in seconds?
No, public disclosures do not establish that the keys can be cracked in seconds; they only confirm that a researcher demonstrated control over them.
Which vendors blocked the compromised certificates?
Mozilla, Chrome, Apple, and Microsoft all blocked the affected certificates between October 17 and October 20, 2026.
Did eMudhra revoke the compromised certificates?
Yes, eMudhra has revoked the eight compromised intermediate certificates, though revocation alone does not protect every application.
