Google and Mozilla revoke eight eMudhra intermediates after weak keys
Original title: Google, Mozilla revoke eMudhra intermediates after private key compromise
Keys were trivially recoverable from public certificates; Google saw no chaining TLS certificates in CT logs before blocking.
Mozilla received a report on October 17 that private keys for eight eMudhra intermediate certificate authorities were compromised, then independently recovered the keys the same day and called generation flawed and trivial to exploit. Six intermediates were for TLS and two for code signing. Chrome and Firefox blocked them, and Google scheduled removal of emSign ECC Root CA – G3 from the Chrome Root Store on October 27. eMudhra says the intermediates issued no end-entity certificates and that its root keys were unaffected.
Unconfirmed: eMudhra says no end-entity certificates were issued, while a key holder could still forge them; the 30,000 figure is one estimate.
- Scott Helme recovered all eight keys from public certificates in under a second.
- Chrome blocked the intermediates without requiring a browser update or restart.
- Cloudflare reported no active exploitation on its services after October 19 mitigations.
- Security Brigade estimated about 30,000 legitimate certificates would need migration.
- eMudhra said the intermediates were created in an April 2025 ceremony.
Impact: Forge trusted HTTPS or code-signing certificates and impersonate sites
| Product | Affected |
|---|---|
| eMudhra intermediate certificate authorities | eight intermediates from an April 2025 ceremony |
- 1.Confirm clients reject certificates signed by the compromised intermediates, including cross-signed chains.
- 2.Check non-browser trust stores in Java apps, appliances, and payment integrations.
- 3.Prepare for removal of emSign ECC Root CA – G3 from the Chrome Root Store on October 27.
- Vendors
- eMudhra
- Products
- emSign ECC Root CA – G3
- Organizations
- GoogleMozillaCloudflare
- Countries
- India
From the original article
4 min read at csoonline.com
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or services, according to Google and Mozilla. “On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.