Why Did Apple, Google, Microsoft, & Mozilla Block Certificates From Indian Firm eMudhra?

Google, Apple, Mozilla and Microsoft have blocked eight certificates from Bengaluru-based eMudhra, because flaws in how they were created could let attackers impersonate legitimate websites. The move is a rare, coordinated response involving all four major platform companies. Here is what happened and why it matters.

What is a certificate authority?

When you visit a secure website, your browser checks a digital certificate to confirm the site is genuine. Certificates are issued by certificate authorities (CAs), and browsers and operating systems keep lists of the CAs they trust. eMudhra is an Indian CA that sells certificates under the emSign brand through companies in India, the United States and the Netherlands. It has roots in the Mozilla, Chrome and Apple root stores.

What went wrong

The problem lies in the private keys behind eight of eMudhra’s intermediate certificates. These are the credentials that sit between a CA’s root and the certificates it issues to websites. Mozilla’s incident report found that all eight keys were generated in April 2025 and were smaller than 256. One of them was the number 4. Keys that small can be guessed almost immediately.

eMudhra attributes the flaw to an April 2025 key ceremony, the formal process in which CAs generate their keys. The company says an independent researcher found over the weekend of October 17 that the weak keys could be reverse-engineered, possibly with AI-assisted techniques.

Mozilla cryptography engineer Dennis Jackson wrote that Mozilla recovered the private keys on its own and confirmed the process was flawed and trivial to exploit.

Why is this serious?

Whoever holds those keys can issue fake certificates for any website. An attacker who intercepts a user’s connection could then pose as a legitimate site and potentially read or alter the information exchanged, Mozilla said. In practice, that could mean a fake banking or email page that looks completely genuine to the browser.

Six of the affected certificates are for TLS, the technology behind secure web connections, and are trusted by the Chrome, Mozilla, Microsoft and Apple root programs. The other two are for code signing and are trusted by Microsoft.

How the response unfolded

October 17: A researcher reported the compromise to the root programs that evening. Chrome and Firefox blocked the eight certificates within hours, after Chrome verified the findings. Mozilla’s block reached Firefox in under three hours through a background list, so users did not need to update or restart. z

October 19: Apple blocked the certificates, and Android devices received an equivalent block through Google Play Services.

October 20: Microsoft blocked them. Mozilla and Google’s Chrome Root Program also confirmed the compromise that day.

eMudhra has revoked all eight certificates and stopped issuing new ones under the affected root. Google is removing that root from Chrome. The Go programming language project has also shipped a fix, tracked as CVE-2026-111943, that makes certificate checks reject any chain containing the eight intermediates.

Who is still at risk?

Browsers and operating systems received the blocks automatically in most cases, but not all software does. The threat remains for applications and systems that do not get these blocks automatically. Administrators may need to update runtimes, containers, API clients and custom trust stores. Applications built with Go must be rebuilt with patched versions to receive the fix.

Has this happened before?

Browser makers have distrusted CAs in the past. Mozilla and Google removed certificates from StartCom, and later WoSign, over repeated faults. Mozilla acted in October 2016 and Chrome in March 2017. The eMudhra case differs in speed and cause: the blocks came within days, and the trigger was a key-generation failure rather than a long record of misconduct.

Published on: Wednesday, October 21, 2026, 04:16 PM IST