Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys were compromised.
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys were compromised.
Google, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers to impersonate any legitimate website or service.
The affected keys were associated with intermediate certificates issued by Indian CA eMudhra. Six were used to issue TLS certificates for websites while the other two were used for code signing.
Preventing Fraudulent Certificate Misuse
The blocks are designed to prevent browsers and applications from trusting fraudulent digital certificates that attackers might issue using the compromised keys, reducing the risk of website impersonation and the potential interception of encrypted communications.
However, the protections do not automatically extend to all users and applications. Mozilla, Google, and Apple have distributed blocks through their respective certificate-revocation mechanisms, while applications built with Go must be rebuilt using patched versions to receive the fix. Other software may also require updates, depending on how they manage certificate trust.
What remains unclear is whether attackers might have already used the compromised keys to issue fraudulent certificates. Google said its Certificate Transparency protections would have prevented affected TLS certificates from being trusted by default in Chrome before the blocks took effect.
Mozilla, meanwhile, said users with standard Firefox configurations received its block without needing to update or restart the browser. Go project maintainers said they “highly recommend” upgrading immediately to patched Go versions 1.27.3 and 1.26.10.
eMudhra is an India-based company that provides digital identity, electronic signature, and public key infrastructure (PKI) services. The company’s services include issuing digital certificates to authenticate websites, electronic document signing, digital identity verification, and securing online transactions.
Dennis Jackson, a member of Mozilla’s cryptography engineering team who is maintaining a timeline of the incident, described eMudhra as having revoked the compromised intermediate certificates. “This has already been remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets,” he wrote. “However, many other clients do not consume revocation information and require software updates to ensure they no longer trust the compromised intermediates.”
Jackson recommended that users update their operating systems and browsers to the most recent versions as quickly as possible.
Details of Compromise Remain Unclear
For the moment, at least, no details are available on how the eMudhra compromise happened, or when. According to Jackson, Mozilla first learned of the compromise on Oct. 17 from a researcher who identified themselves only as Wayne. The researcher demonstrated that he had access to the private keys associated with all eight intermediate certificate authorities by using each key to create a digital signature on the same short message: “We have a problem here – Wayne.”
Mozilla completed the process of blocking the compromised certificates about three hours later. “Mozilla’s centralized list of revoked certificates which we introduced in 2015. OneCRL allows us to deliver this protection without requiring users to update or even restart Firefox,” Jackson said.
Since then, Mozilla has been working with eMudhra “other root programs and downstream trust store operators to investigate the root cause, responsibly disclose the incident and help protect the wider ecosystem.” Currently, Mozilla has no evidence that other CAs might have been similarly impacted he added.
Posting in the same group, a member of Google Chrome’s Root Program Team described receiving news of the compromise around the same time that Mozilla did and addressing the issue in less than two hours.
“Following the initial block, we evaluated all other CA certificates in the Chrome Root Store trust boundary and found no other instances of this failure mode,” the Chrome team member wrote, “We are also working with CT log software maintainers and log operators to reject certificates chaining to these compromised intermediate CAs going forward to prevent risk to the CT ecosystem.”
Maintainers of the Go project, meanwhile, did not identify eMudhra by name. Instead, they merely noted their plans to block trust “in a small set of intermediate certificates” because of an unspecified operational security concern.
For organizations seeking to assess their exposure, the affected certificates include six TLS intermediates — EM DV TLS CA, EM OV TLS CA, and EM EV TLS CA, each with G3B and G3C variants — issued under emSign Root TLS CA – G3. The affected certificates also include two code-signing intermediates, EM OV CS CA – G3B and EM OV CS CA – G3C, issued under emSign Root CS CA – G3.
Compromises and errors involving certificate authorities have repeatedly forced browser makers to revoke trust in digital certificates over the years, In 2011, a breach at Dutch CA DigiNotar.
In 2017, Google, Mozilla, and other browser makers took issue with Symantec’s chronic mis-issuance of certificates and moved to revoked in the CA; the dispute ended with Symantec eventually selling its CA business to DigiCert later that year. More recently, in 2025, Google announced it would no longer trust certificates from Chungwa and Netlock, over concerns about the integrity of their operations.
