- Trending
- Comments
- Latest
Google, Apple, Microsoft and Mozilla have blocked eight digital certificates issued by India’s eMudhra after researchers found their private keys could be recovered, a flaw that could let attackers build convincing fake websites, including phishing clones of crypto exchanges and wallets.
Major technology companies have stepped up security measures after discovering a cryptographic flaw affecting eight digital certificates issued by Indian certificate authority eMudhra Limited, according to reports published on October 20 and 21, 2026.
The affected eMudhra certs had private keys that could be recovered because of weaknesses in their generation, potentially allowing attackers to create fraudulent certificates and impersonate legitimate websites.
The incident has prompted a coordinated response from major browser developers and technology providers, including Google, Mozilla, Apple and Microsoft. Their actions are intended to prevent the compromised certificates from being trusted by vulnerable systems and reduce the possibility of attackers intercepting sensitive communications.
The Chrome Root Program received a report about the compromised private keys on October 17, 2026. Google subsequently verified the findings and implemented protections for Chrome users.
Mozilla cryptography engineer Dennis Jackson described the underlying problem in an incident report, writing that the key-generation process was “flawed” and “trivial to exploit.”
His assessment underscores the seriousness of the failure: security systems that depend on mathematical unpredictability can become unreliable when their underlying keys are generated improperly.
Digital certificates play an important role in securing internet connections. They help browsers verify that a website is associated with the domain it claims to represent and support encrypted communication between users and online services.
Certificate authorities issue and sign certificates that browsers and other software use to establish trust. Intermediate certificates sit within this chain of trust, allowing authorised entities to issue additional certificates without directly using the root authority’s private key.
The problem with the affected eMudhra certs was that their private keys were generated with insufficient randomness. This weakness made it possible for a researcher to recover the keys rather than relying on the enormous computational effort normally required to break properly generated cryptographic keys.
If an attacker obtained or reconstructed a compromised private key, they could potentially create certificates that appear legitimate for unrelated domains.
Depending on the victim’s software and the protections in place, this could facilitate website impersonation, interception of communications or manipulation of information exchanged between a user and a server.
Google’s response is detailed in its October 20 security announcement, which explains how the company blocked the affected certificate authorities within Chrome’s security infrastructure.
The response has extended across several major technology companies as security teams work to prevent the compromised certificates from being accepted by their products.
Mozilla said it blocked the affected certificates in Firefox through its OneCRL mechanism on October 17, shortly after receiving the report.
The company also released browser updates to cover users whose customised settings might prevent them from receiving the standard revocation updates.
Google’s Chrome team implemented a Certificate Revocation List Set (CRLSet) update to block the affected certificate keys. Apple and Microsoft subsequently introduced protections for their respective platforms, according to the incident reporting.
Cloudflare also disclosed its response in an official technical report, explaining that it became aware of the issue on October 19 and deployed measures to protect its services and customers.
Dennis Jackson also cautioned against assuming that the browser response had eliminated every possible risk. In the incident report, he stated: “We do not know if attackers exploited the flawed key generation to target these clients.”
The uncertainty concerns software outside the browser ecosystem, particularly applications that do not enforce Certificate Transparency or receive certificate-revocation information automatically.
Certificate Transparency provides publicly auditable records of certificate issuance, helping security teams identify suspicious certificates.
Mozilla reported no evidence that Firefox, Chrome, Edge or Safari had been attacked using the compromised certificates. That is an important distinction, although it does not establish that every application or device was safe.
eMudhra has also published an official statement on the certificate security incident. The company said it was investigating the affected certificates, had initiated containment measures and was working with browser and root-store operators.
The incident reinforces a fundamental security principle: a website that appears trustworthy is not necessarily safe simply because the browser displays an encrypted connection.
Investors should keep their browsers, operating systems and security applications updated, particularly when providers release emergency fixes.
They should also access exchanges and wallet services through verified bookmarks or independently confirmed official links rather than advertisements, unsolicited messages or search results that could lead to imitation websites.
Users should never enter seed phrases or private keys into websites claiming to verify an account, restore access or resolve a security incident. Legitimate support teams do not need a wallet’s recovery phrase to investigate an ordinary customer-service request.
The eMudhra certs incident also illustrates why investors should consider security beyond blockchain protocols. Even when a cryptocurrency network functions as intended, attackers may target the websites, devices and communication channels people use to interact with it.
There is currently no verified evidence in the cited reports that the compromised certificates were used to steal cryptocurrency. Investors should therefore avoid treating the disclosure as proof that exchanges or wallets have been breached.
The immediate concern is the possibility of impersonation and the uneven deployment of protective measures across different software environments.
The blocks introduced by major technology companies have reduced the risk for users covered by those protections, but systems that do not receive or enforce the updates may require additional attention.
Copyright © 2025 - The Bit Gazette.
