Exposure of Keys for 8 eMudhra Certificates Prompts Mozilla Block Amid Security Fallout

Key Facts

Mozilla blocked eMudhra intermediate certificates on October 17 after a report of exposed private keys included proof of control over the keys for all eight affected certificates, according to its security record. The incident involved certificates for encrypted connections and software signing, according to an assessment of its scope published by Sonatype. Sonatype identified 6 Transport Layer Security certificates and two code-signing certificates. India's Computer Emergency Response Team said the private key values used with the P-384 cryptographic curve were smaller than 256. The team said these values allowed the private keys to be recovered almost instantly from their corresponding public keys.

The eight intermediate certificates originated from a key-generation ceremony conducted by eMudhra on April 30, 2025, according to the company's published timeline explaining the incident. The company pinpointed the flaw to a key-wrapping and unwrapping step during that ceremony. It said this step produced weak keys alongside the original strong keys. While identifying this stage, it kept its investigation into the source of the problem open, saying: "We have not yet confirmed the precise root cause." It acknowledged that the flaw remained undetected for about 18 months. It added that it went unnoticed through two independent audit cycles during that period. Describing the incident, eMudhra said: "Our infrastructure was not compromised, and no data leak occurred."

eMudhra announced that it revoked all eight intermediate certificates on October 18, 2026, as part of its response to the incident. Mozilla implemented the block through the central revocation list whose updates reach Firefox. The company also included a fix in version 158.0.1 of the browser, embedding the blocklist in the update itself. Mozilla said this protects clients even when the Remote Settings service is disabled by enterprise policy. The protection also covers users whose network conditions prevent access to that service, according to the company's security advisory. The fix thus covered environments that prevent revocation-list updates from arriving through the service, alongside those that receive them.

The response extended to services and applications, with Cloudflare saying its security review found no active exploitation of the issue on its services. It announced updates to WARP and cloudflared as part of its response to the affected certificates. It also deployed protective measures across its content delivery network products, developer products and Zero Trust services. The Ubuntu Security Team, meanwhile, removed the relevant trust roots from the certificate authority package, according to its announcement on available fixes. The team warned that legitimate certificates whose trust ultimately derives from those roots would also lose trust. Sonatype said in its guidance on handling the incident that existing Docker container images and Java Virtual Machine environments bundled with its products do not receive updates automatically.

On the commercial front, eMudhra said the affected business accounts for about 1% of company revenue, according to its statement on the removal of trust in its certificates. In the same statement, it acknowledged that the incident could entail reputational risks that cannot be quantified. The company said: "This may entail some reputational risks for eMudhra that cannot be quantified," alongside the revenue share it identified for the affected business. In the market, eMudhra shares reached 365.5 rupees on India's National Stock Exchange during the October 22, 2026, session, according to Moneycontrol's coverage. That price was recorded at 11:47 a.m. India time during the trading session.

As its next steps, eMudhra is offering all its enterprise customers in the Transport Layer Security certificate business certificates from an additional publicly trusted issuer. The company said this arrangement allows customers to switch between certificate authorities when a problem occurs. On Chrome, India's Computer Emergency Response Team said the block was based on Subject Public Key Information fingerprints for the affected certificates. It added that the measure aims to protect users from certificates using the public keys involved in the incident. According to the team, removal of the affected root is expected to reach devices relying on the Chrome Root Store on October 27, 2026.