Why eight compromised eMudhra certificates raised an HTTPS warning
Mozilla says private keys linked to eight intermediate certificates issued under eMudhra’s public trust system were compromised, creating a risk that attackers could mint fraudulent HTTPS certificates. Firefox blocked the affected certificates for users with standard configurations within three hours of Mozilla receiving the report on October 17.
The incident matters because a trusted intermediate certificate can be used to sign certificates for websites. If an attacker could also intercept a connection, a fraudulent certificate might help impersonate a site and read or alter traffic. Mozilla has not reported evidence in its post that this happened.
:
What are intermediate certificates and why are they important?
Every time you visit a website that starts with HTTPS, your browser checks a digital certificate to verify that it is connecting to the correct website. Think of it as a digital identity card that helps establish whether a website is genuine. These certificates form part of the security system that protects online banking, shopping, emails and other internet services.
A Certificate Authority (CA) is a trusted organisation that issues these digital certificates. At the top of this system sits a root certificate, which browsers and operating systems recognise as trustworthy. Below it are intermediate certificates, which act as authorised middlemen. They allow certificate authorities to issue website certificates without using their most sensitive root keys for everyday operations.
Each intermediate certificate has a private key, which works like a secret digital signature. If hackers steal that key, they could potentially create fraudulent website certificates that appear legitimate to browsers trusting the affected authority. In certain circumstances, particularly if attackers can intercept internet traffic, this could allow them to impersonate genuine websites and potentially access sensitive information.
In the eMudhra incident, private keys linked to eight intermediate certificates were reportedly compromised. This created a potential security risk for websites and users.
:
How Firefox users were protected
Mozilla added the eight certificates to OneCRL, its centrally distributed revocation list. The block reached standard Firefox configurations by 22:59 UTC on October 17 without requiring a browser restart or manual update.
Firefox 158.0.1 for desktop and Android, along with ESR 115.43.1 and ESR 153.5.1, was released for the smaller group whose custom settings may have blocked the OneCRL update. Mozilla also updated its NSS trust store to remove the root certificate that signed the affected intermediates, helping protect other software that relies on Mozilla’s certificate store.
:
What eMudhra says
eMudhra, an Indian digital-trust company, said the certificates were created during a key-generation ceremony in April 2025. Its investigation remains open. The company said the incident does not affect its root CA private keys or other intermediate authorities.
According to eMudhra, seven affected intermediates were never deployed in production. One was deployed, but neither it nor the other seven issued any end-entity certificates. The company said its internal review and public Certificate Transparency records supported that finding.
Users on standard Firefox settings were already protected automatically. People using custom certificate or update settings should install the latest supported Firefox or ESR release.
Organisations that operate their own trust stores should review Mozilla and eMudhra notices, confirm revocation handling and check whether affected chains appear in their environments.