Eight digital certificates issued by India-based certificate authority eMudhra Limited have been blocked by major technology companies after a flaw in their private-key generation made them potentially easy to guess and misuse.
The certificates could have enabled attackers to create fraudulent HTTPS certificates for legitimate websites. HTTPS certificates help browsers verify that a user is connecting to the intended website and encrypt the connection. If an attacker can obtain or forge a trusted certificate, they may be able to impersonate a site and potentially read or modify information exchanged with its visitors.
According to Cointelegraph, browser developers and other technology companies had introduced protections against the affected intermediate certificates by Tuesday. Mozilla cryptography engineer Dennis Jackson said Mozilla independently recovered the private keys after receiving notice of the issue on Saturday. He described the key-generation process as flawed and trivial to exploit.
Emergency protections across major platforms
Mozilla said its Firefox security team blocked the certificates through OneCRL, its certificate-revocation mechanism, on the same day it received the report. The company also released a Firefox update for desktop and Android users, including custom settings intended to prevent affected users from missing the OneCRL protection.
The certificates were also blocked in Chrome from Saturday, on Apple devices from Monday and on Microsoft platforms from Tuesday, Jackson said. Cloudflare said it learned of the report on Monday and released Tuesday updates for Cloudflare One, WARP Clients and Cloudflare Tunnel, along with additional mitigations across its services.
Jackson said the issue was disclosed to downstream trust stores on October 19. These trust stores help operating systems and applications determine which certificate authorities and certificates they should trust. Many organizations had already issued updates or were working on them.
Browser protections do not cover every system
The immediate response reduced the risk for users of updated browsers and supported services, but the incident may still affect applications and systems that do not automatically receive certificate blocks.
Mozilla said there was no evidence that Firefox, Chrome, Edge or Safari had been attacked using the affected certificates. Certificate transparency logs contained no entries for the intermediate certificates since April 2025, according to Jackson. Those logs provide a public record of many certificates issued for websites.
However, he cautioned that many clients outside the browser ecosystem do not enforce Certificate Transparency. Mozilla therefore could not determine whether attackers had used the weak key generation to target those systems.
The episode has similarities to the 2011 DigiNotar breach, in which hackers compromised a Dutch certificate authority and issued 531 fraudulent SSL certificates. Those certificates were used to impersonate Google and spy on about 300,000 Iranian Gmail accounts. The eMudhra incident differs in the reported cause: the concern described by Mozilla was an insufficiently secure private-key generation process.
Moneyiar market picture
Moneyiar market data at 08:38-08:39 on October 21, 2026, showed Ethena (ENA) at $0.2027011957, up 9.02% over 24 hours but down 3.62% over seven days. AKEDO (AKE) was $0.0349120465, rising 3.04% in 24 hours and 35.04% over seven days.
Allora (ALLO) traded at $0.2090989998, up 3.21% over 24 hours and down 10.74% over seven days. ONEchain (ONE) stood at $0.1026762974, with a 24-hour gain of 0.54% and a seven-day decline of 12.49%.
