Mozilla, Google and Apple block compromised eMudhra certificates
Original title: Mozilla, Google, Apple block compromised eMudhra CA certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
Researcher Wayne found on October 17 that eight eMudhra intermediate certificates used P-384 private keys smaller than 256, generated in April 2025. Anyone could recover them by testing 256 values and forge trusted website certificates. eMudhra blamed a script that selected a weaker key set and said most intermediates were never used in production. Mozilla, Google, and Apple blocked the certificates; Go fixed the issue in 1.27.3 and 1.26.10 as CVE-2026-111943.
Unconfirmed: eMudhra says it found no evidence the intermediates issued end-user certificates or were abused.
- Flüpke published a key for EM OV TLS CA - G3C with value 4; BleepingComputer verified it.
- Firefox blocked certificates via OneCRL on October 17; Apple added protections on October 19.
- Firefox 158.0.1 and ESR updates shipped October 20 for clients that missed revocation.
- macOS built-in curl may still trust the intermediates because it skips revocation checks.
Impact: forge trusted certificates and intercept encrypted website traffic
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra intermediate CA certificates | eight certificates with P-384 keys generated in April 2025 | revoked |
| Go | — | 1.27.3 and 1.26.10 |
| Mozilla Firefox | — | 158.0.1 and ESR updates |
- 1.Install available browser, OS, and library updates that distrust the revoked intermediates.
- 2.Use the advisory test endpoints to check whether systems still trust the certificates.
- 3.Update Go to 1.27.3 or 1.26.10.
- CVEs
- CVE-2026-111943
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111943 | On most platforms, Go uses the given system root certificates | — | <1% | PoC |
From the original article
3 min read at bleepingcomputer.com
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.