- eMudhras’ weak private keys exposed eight certificates to potential misuse, raising concerns about fake websites and HTTPS security.
- Google Chrome, Mozilla Firefox, Apple, and Microsoft blocked the affected certificates using emergency security updates.
- Old applications and systems that do not check certificate revocation could still be at risk of man-in-the-middle attacks.
Eight compromised digital certificates issued by the Indian certificate authority eMudhra have triggered emergency security updates across major technology platforms, raising concerns about fake websites, data theft, and outdated software.
eMudhra’s Weak Private Keys Raise HTTPS Security Risks
The vulnerability came to light on October 17, when a researcher alerted browser developers that eight intermediate certificates issued by eMudhra had dangerously weak private keys. According to Mozilla cryptography engineer Dennis Jackson, Mozilla independently recovered the keys, confirming that the flaw was easy to exploit.
Certificate authorities issue certificates that browsers use to verify website identities. When attackers get the keys, they can forge fraudulent certificates. Those fraudulent certificates let fake websites look legitimate. An attacker who can intercept a connection might impersonate a website. That attacker can then. Alter the data that is exchanged.
According to researchers, eMudhra used tiny integers like 4, 56, and 237 as private keys instead of strong 384-bit random numbers.
— Cyber Security News (@The_Cyber_News) October 21, 2026
Security researcher Scott Helme reported recovering all eight keys in under a second. Some reportedly used extremely small numbers, including 4, 56, and 115, instead of securely generated random values. The keys had reportedly been exposed since April 2025.
Google, Mozilla, Apple & Microsoft Block Compromised Certificates
Technology companies moved quickly to limit the threat. Mozilla blocked the affected certificates through its OneCRL system on October 17 and subsequently released Firefox updates for desktop and Android users with custom security settings.
Chrome also blocked the certificates on October 17, followed by Apple on October 19 and Microsoft on October 20. Cloudflare introduced additional protections across its services, including updates for Cloudflare One, WARP clients, and Cloudflare Tunnel. The affected certificates have also been revoked.
Mozilla said that it found no proof that people who use Firefox, Chrome, Edge, or Safari were attacked by the compromised certificates. However, the absence of entries in certificate transparency logs does not rule out attacks against other applications.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment