Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them

HTTPS certificates from eMudhra can no longer be trusted to verify website identity.

Mozilla has blocked eight intermediate TLS certificates issued by eMudhra due to the compromise of their private keys. The compromised keys, ranging from 3 to 8 bits in size, could allow attackers to forge HTTPS certificates, enabling them to impersonate websites and potentially intercept or alter user traffic. Mozilla's security team received a report of the compromise on October 17, 2026, and acted swiftly. Within three hours, they deployed a block of these certificates to all Firefox users via their OneCRL system. Additional updates to Firefox (versions 158.0.1, ESR 115.43.1, and ESR 153.5.1) and the NSS trust store (NSS 3.131.1) were released to ensure protection for all users and applications utilizing Mozilla's trust infrastructure, even those with custom settings or not receiving OneCRL updates.

The rapid response from Mozilla, blocking compromised eMudhra certificates within hours, highlights the critical importance of automated revocation systems like OneCRL in mitigating widespread security threats. This incident underscores the vulnerability of Certificate Authorities (CAs) to key compromises and the cascading effect such breaches can have on the entire web PKI ecosystem. The fact that such small key sizes were involved also raises questions about eMudhra's internal security practices and the effectiveness of current standards in preventing such weak key generation.

This event will likely prompt increased scrutiny of CA security audits and key management policies by browser vendors and regulatory bodies. Users who rely on applications that do not automatically update their trust stores or receive OneCRL updates may remain at risk until those systems are manually updated. The incident serves as a stark reminder that the security of the internet relies on the diligent practices of a few key players, and a single point of failure can have significant implications for user trust and data security.