NEW DELHI: Major technology firms including Google, Mozilla, Apple, and Microsoft have moved to block eight intermediate digital certificates operated by Indian certificate authority eMudhra following the compromise of their private cryptographic keys. The exposure presented significant risks across the web, as unauthorized actors holding the keys could theoretically have generated fraudulent HTTPS certificates to impersonate banking, email, and government portals. While eMudhra has revoked all eight certificates and initiated an investigation alongside browser trust programmes, no evidence has emerged to show that any fraudulent certificates were publicly issued or exploited prior to containment.
Scope of the Compromise and Discovery
The security lapse involves eight intermediate certificates created during a key-generation ceremony on April 30, 2025, linked to eMudhra operations in the Netherlands and the United States. Six of the credentials were Transport Layer Security certificates meant for establishing encrypted HTTPS connections, while the remaining two were intended for code signing to verify software integrity. A security researcher discovered the vulnerability and notified Mozilla on October 17, demonstrating the usability of the keys by signing a short test message with each of them without publishing the keys themselves. Speculation has surfaced regarding whether the private keys were stolen or generated with critical cryptographic weaknesses that made them easily guessable, but eMudhra has yet to confirm the technical root cause of the incident.
Swift Action Across Browsers and Developer Ecosystems
Following the disclosure, browser operators and operating system developers took swift measures to protect users by updating their certificate revocation lists and trust stores. Mozilla updated its revocation mechanisms for Firefox, while Google Chrome blocked the certificates across its core security infrastructure. Apple applied defensive updates on October 19, followed by Microsoft updating its trusted certificate directory on October 20. The remediation effort extended into the software development ecosystem, where maintainers of the Go programming language published security releases across versions 1.27.3 and 1.26.10 to block the affected keys directly. Updates have also rolled out for security components including Python’s Certifi library and Rust’s webpki-roots, though administrators must rebuild applications or apply updates manually in environments that do not automatically synchronize revocation data.
Company Reassurances and Protective Measures for Systems
eMudhra has stressed that the compromise was confined entirely to the eight intermediate certificates and did not affect its primary root certificate authority keys or other operational intermediates. The firm stated that none of the compromised intermediates had been used to issue live customer certificates, leaving existing end-entity certificates intact. System administrators, developers, and everyday internet users have nonetheless been advised to verify that their environments are secured against the revoked certificates. Users are urged to install the latest operating system, browser, and software updates to ensure revocation rules take effect, particularly when operating on public networks. For organizations running Linux platforms or internal services that maintain static trust stores, technical teams must audit their configurations and apply software patches to ensure connections relying on the invalid certificates are consistently rejected.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
