Exposure of Keys for 8 eMudhra Certificates Prompts Mozilla to Distrust Them
Key Facts
Mozilla confirmed that the private keys for 8 eMudhra intermediate certification authority certificates had been exposed after receiving a report on 17 October at 20:06 UTC that included proof of control over all the certificates' keys. The incident includes 6 intermediate certificates designated for Transport Layer Security connections, according to Sonatype's assessment. The other two certificates are used for code signing, extending the incident's scope to certificates for encrypted communications and software signing. Cloudflare warned that the weak keys allow an attacker to create a forged certificate for any domain and use it to impersonate servers. It said such impersonation could allow traffic to be intercepted or modified, the security risk that measures to distrust the affected certificates seek to address.
The eight intermediate certificates date back to a key-generation ceremony held on 30 April 2025, according to the incident timeline published by eMudhra. The Indian Computer Emergency Response Team confirmed that the affected private-key values were below 256, despite being used with the P-384 cryptographic curve. It said these values allow the private keys to be recovered almost instantly from their corresponding public keys, making the weakness in key generation itself a route to accessing the keys. Mozilla independently recovered the keys and concluded that their generation process was flawed and easily exploitable. But eMudhra left the origin of the flaw unresolved, saying in its update: "We have not yet confirmed the precise root cause."
As part of its protective measures, Mozilla used its centralized revocation list to block the affected certificates in Firefox. It explained in its security blog that this mechanism delivers protection to users without requiring a browser update. It added that applying the protection also requires no Firefox restart, allowing the block to be implemented through the revocation mechanism itself. An additional Mozilla measure removed the root certificate that signed the affected intermediate certificates from the trust list in the Network Security Services library. For its part, eMudhra said none of the intermediate certificates concerned had been used to issue certificates, an assertion the company attributed to its assessment of the incident.
On the commercial front, eMudhra said the affected global Transport Layer Security certificate business accounts for about 1% of its revenue, defining the size of the business directly affected by the incident. But it acknowledged in its statement that the incident could entail reputational risks that cannot be quantified, alongside the commercial impact it identified. It said distrusting the root affects one customer ecosystem in the United States, according to its update on the security incident. In the market, eMudhra shares closed on India's National Stock Exchange at 432.00 rupees on 21 October 2026, down 20.00% on the day, according to historical price data published on Investing.com. By comparison, the shares had closed at 540.00 rupees in the 19 October 2026 session.
Cloudflare said its security review had detected no active exploitation of the issue on its services, while warning against relying solely on a browser test to assess protection in other systems. It explained that "passing a browser test does not prove that the backend service is protected," pointing to the need to distinguish between browser protection and protection for backend services. Sonatype, for its part, confirmed that the current Docker container images bundled with its products do not receive updates automatically. The same applies to the Java Virtual Machine environments bundled with those products, according to the company's guidance on handling the incident. As for the next dated step, the Indian Computer Emergency Response Team reported that the Chrome Root Store change is expected to reach devices that rely on that store on 27 October 2026.