Google, Mozilla, Apple and Microsoft Block Vulnerable eMudhra Certificates

Google, Mozilla, Apple, and Microsoft urgently responded to eight vulnerable intermediate certificates from the Indian certification authority eMudhra, with the issue becoming known on October 17. Six certificates were for HTTPS, and two were for code signing. Due to weak private keys, it was possible to forge certificates of other sites and, when intercepting a connection, present a fake resource as genuine, such as a cryptocurrency exchange or wallet site. Mozilla engineers themselves restored the keys, confirming that the vulnerability is easy to exploit.

The reason was a key generation error in April 2025. The certificates used the P-384 curve algorithm, but instead of random large numbers, the keys had values less than 256, so brute force would take no more than 256 attempts. The issue was not with the strength of P-384 but with incorrect generation. The vulnerability was first discovered by a researcher under the pseudonym Wayne, who provided browser developers with proof of possession of all eight keys. eMudhra confirmed that the keys were created in April 2025 and stated that root and other intermediate centers were not affected.

The risk was extensive, but the consequences were less severe: according to eMudhra, only one of the eight certificates was used in the working infrastructure. There were no records of TLS certificates through the six affected centers in Certificate Transparency. Chrome blocked the keys on October 17 via CRLSet, and Mozilla added them to OneCRL the same day – protection reached users with standard settings in less than three hours. Apple blocked the certificates on October 19, and Microsoft on the 20th; Cloudflare updated WARP and Cloudflare Tunnel and strengthened protection in CDN and Zero Trust.

There are no confirmations of exploitation against Firefox, Chrome, Edge, and Safari users, nor signs of attacks on Cloudflare services. Nevertheless, Mozilla is excluding the root certificate emSign ECC Root CA – G3 from the NSS store, and Google will do the same in the Chrome Root Store from October 27. eMudhra will cease issuance through this root and migrate clients to other infrastructure: about 30,000 certificates will need to be replaced, approximately 97% of which were issued via ACME.