Google and Mozilla have blocked eight certificate authorities run by Indian security company eMudhra, and Apple and Microsoft have reportedly followed. A researcher showed that anyone could work out their private keys from public data in milliseconds. Chrome will also drop the root behind them, emSign ECC Root CA – G3, on the morning of October 27, Pacific time, Google said on October 20.
For most Americans using Chrome, Firefox or Safari, browser makers closed the risk within hours. The leftover exposure sits in apps, servers and developer tools that never check revocation lists. Those need updates. Website owners on the affected root also have days to switch certificates before Chrome cuts them off.
Why a weak key lets anyone fake a website
Every HTTPS site proves its identity with a certificate. Your browser accepts it because a certificate authority signed it, and a “root” stored on your device vouches for that authority. An intermediate authority sits in the middle of the chain and does the day-to-day signing.
Whoever holds an intermediate’s private key can sign certificates that browsers accept. In its post to the dev-security-policy forum, Mozilla warned the keys “could allow attackers to issue fraudulent HTTPS certificates.” A forged certificate for a bank would make a fake login page look real, padlock included. That’s exactly what phishing crews that impersonate trusted names want.
These keys should be impossible to guess. A P-384 key, the type used here, is a number about 116 digits long. Yet all eight eMudhra keys were smaller than 256, according to Mozilla’s incident report on Bugzilla. Trying 256 numbers would find each one.
Security researcher Scott Helme recovered all eight, and one was simply the number 4.
Browsers blocked the keys within hours
The keys came out of a key generation ceremony on April 30, 2025. A researcher identified as Wayne reported the flaw to all four companies and eMudhra at 18:05 UTC on Saturday, October 17.
Chrome pushed a blocklist update at 19:45 UTC. Google says it protected users “without requiring a browser update or restart.” Mozilla recovered the keys on its own at 21:48 UTC. It finished blocking them in Firefox at 22:59 UTC. On the morning of October 18, eMudhra revoked all eight certificates.
Apple followed on October 19 and Microsoft on October 20, says an incident tracker run by Mozilla engineer Dennis Jackson. Android phones got Google’s block through Google Play Services around 22:00 UTC on Monday, October 19. Restarting a phone pulls it in at once, Google says.
Six of the eight authorities issued website (TLS) certificates. The other two signed software, which matters mostly on Windows. Sectigo had cross-signed all eight under its older AAA Certificate Services root in May 2025, Helme found. Sectigo has since revoked those copies too, BleepingComputer reported.
Why the whole root is being pulled
Blocking eight certificates wasn’t enough, because many devices never download blocklists. On October 20, Mozilla said “multiple individuals have independently recovered the private keys,” some of them publicly.
So Mozilla ordered the emergency removal of emSign ECC Root CA – G3. The goal is to protect software that ignores revocation data. Chrome follows on October 27.
That root covers far more than eight bad intermediates. eMudhra told Mozilla that about 30,000 certificates chaining to it need to move. Roughly 97% came through ACME, the automated system many sites use for renewals.
eMudhra plans to shift those customers to its older RSA root, emSign Root CA – G1. Mozilla is not removing that root “at this time.” Google says it is investigating whether eMudhra’s remaining CA certificates should stay in Chrome.
Google adds one reassurance. Chrome requires trusted certificates to appear in Certificate Transparency, a public log. No website certificate from the six TLS authorities ever showed up there before the block. So no forged certificate from these keys could have worked in Chrome.
Most command-line tools and programming languages skip that check. Helme built a test certificate for api.stripe.com, and curl, Python and Node all accepted it.
Fixes are shipping now. Jackson’s tracker lists patched releases for Python’s certifi (2026.10.19), Node.js, Go and the major Linux distributions. Java was still pending on October 20.
What eMudhra says went wrong
eMudhra filed a press release with India’s stock exchanges on October 21. It blamed “a wrap/unwrap step” in the ceremony, which produced a second set of weak keys alongside the strong ones. Those weak keys went to the browser root stores. The company says it is still working out the root cause.
eMudhra says nobody compromised its infrastructure and no data leaked. Its Indian digital signature (DSC) and eSign services run on separate systems and work normally, it says. The global TLS business brings in about 1% of revenue. Still, the company warned of reputational risk “which cannot be quantified.” Its shares fell about 20% to ₹432 on the National Stock Exchange on Wednesday, the Free Press Journal reported.
eMudhra also told Mozilla it built the G3B and G3C authorities for its European and US operations. Only one reached production, it said, and none issued certificates to customers. The filing credits the researcher with spotting the flaw “possibly with AI-assisted techniques,” echoing other cases of AI tools surfacing security flaws.
But this flaw needed no sophistication. Anyone who checked could have found the keys any time since April 2025. That’s why browser makers treated them as public.
What to do before October 27
If you browse on an updated phone or computer, you’re already covered. Install pending updates and restart your Android phone. Never click past a certificate warning on a banking or email site. Two-factor authentication also limits the damage if you ever type a password into a convincing fake.
Developers and IT teams should update CA bundles in runtimes, containers and devices. Jackson’s tracker flags a Mac quirk. The curl, Python and OpenSSL tools built into macOS read /etc/ssl/cert.pem without revocation checks, so they can still trust the bad intermediates.
Site owners on emSign ECC Root CA – G3 “must immediately acquire and install a new TLS certificate” from another provider, Google said. Otherwise Chrome users will see errors after October 27. Chrome’s root program is still weighing eMudhra’s other certificates and has promised updates on the Common CA Database public list.
