Apple, Google Rush to Block eMudhra Security Certificates

Major browsers and operating systems are blocking eight compromised eMudhra security certificates after researchers discovered critically weak private keys, as reported by Bleeping Computer.

The security flaw came to light when a researcher known as Wayne scanned publicly available certificate data. According to incident reports, eight intermediate certificates were discovered to be using P-384 private keys that had values far smaller than intended. These keys were originally generated in April 2025.

Because of the mathematical flaw, an attacker could potentially recover the private key by testing only a very small number of possible values, effectively bypassing standard cryptographic protections. To demonstrate how severe the flaw was, security researcher Flüpke published one of the compromised private keys on GitHub. The public demonstration revealed that the private key for eMudhra’s certificate had a value of just four.

Independent verification confirmed that the published key matched one of the active intermediate certificates, proving that the vulnerability was practical to exploit rather than purely theoretical.

When questioned about how the mistake happened, eMudhra explained that an automated script used during the certificate generation process back in April 2025 contained an error. This error mistakenly produced a secondary set of weaker keys. Because these weaker keys shared similar labels with the properly generated ones, they were accidentally selected during certificate signing.

In response to the vulnerability, Mozilla has blocked the compromised certificates through the Firefox OneCRL system. Google Chrome has blocked the six compromised intermediates that were authorized to issue TLS certificates, while Apple has also implemented protective measures across its operating systems.

Security engineers have set up specialized tracking websites to help system administrators check whether their servers and internal applications are still trusting the revoked eMudhra certificates.