eMudhra Intermediate CA Private Key Compromise
Current overview (not historical)
The private keys for eMudhra's Intermediate CA were compromised due to weak generation using predictable integers like 4, 56, and 237, allowing attackers to recover keys and forge certificates within one second. Major browser vendors including Mozilla, Microsoft, Apple, and Chrome have moved to block the affected certificates. However, the Python ecosystem (uv, pip, certifi) and various Linux distributions remain potentially vulnerable as they do not check certificate revocation status, necessitating updates to certificate trust lists.
Written with AI from the reporting · updated 10/21/2026
EventGraph Explorer
One time cutoff for reports, relations and evidence.
New at this step ·Tech giants block eight eMudhra certificates to prevent fake websites
- Reports in replay
- 3
- First-party
- 0
- Sources
- 3
Reports first seen at this step · 1
- Cointelegraph · Third-partyTech giants block eight eMudhra certificates to prevent fake websitesOriginal source ↗
Discovery-time replay; the linked graph and evidence share this cutoff. The full overview and activity remain current.
Event developments
3 developments10/21/2026, 8:42:11 AM
Private keys of eight eMudhra intermediate CA certificates compromised, affecting major browser trust storesSimon Willison
10/21/2026, 12:31:10 PM
eMudhra certificate authority private keys cracked, browsers block forged certificatesCoinDesk
10/21/2026, 1:29:11 PM
Tech giants block eight eMudhra certificates to prevent fake websitesCointelegraph
Filtered by first discovery; only representative reports already discovered by this cutoff are shown. Story grouping may have changed later, so this is not a complete historical snapshot.
Relations at this time
Loading time-scoped relations…
Bounded reconstruction, not an exact snapshot: entity names, relationship text and story grouping may include later revisions. Overview and full source archive below remain current.
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Oct 20, 00:00recorded Oct 21, 08:42single sourcerevised
eMudhra Intermediate CA Compromise
Read original source ↗ Simon WillisonReplay this moment in the explorer - 2Oct 17, 00:00recorded Oct 21, 12:31single sourcerevised
eMudhra私钥被弱破，8枚证书被撤销
Read original source ↗ CoinDeskReplay this moment in the explorer - 3Oct 21, 00:00recorded Oct 21, 13:29single sourcerevised
Tech giants block 8 eMudhra certs enabling fake sites
Read original source ↗ CointelegraphReplay this moment in the explorer
Uncertainty marks flag where to check the sources; they are not proven causation.
Full source archive (current)
Current public reports; outside the historical replay.
First-party sources · 0 reports
No verifiable reports in this group yet.
Independent coverage · 3 reports
- Cointelegraph · Oct 21, 13:15Tech giants block eight eMudhra certificates to prevent fake websites
Major tech companies including Mozilla, Cloudflare, and browser developers have deployed emergency blocks against eight intermediate certificates issued by India-based eMudhra Limited. The certificates were found to have insufficiently secure private keys, making them vulnerable to exploitation. Mozilla confirmed the key-generation process was "flawed" and "trivial to exploit," allowing attackers to impersonate legitimate websites. While browser vendors have issued protections, systems that do not receive automatic updates remain at risk.
Read original source ↗ - CoinDesk · Oct 21, 12:11eMudhra certificate authority private keys cracked, browsers block forged certificates
Eight private keys belonging to Indian certificate authority eMudhra were compromised due to the use of easily guessed small integers, allowing researchers to recover all keys from public certificates in under a second. Major browser makers including Mozilla, Chrome, Apple, and Microsoft have blocked the affected certificates, but non-browser software such as Python, Node, and Go runtimes may remain vulnerable as they often do not check certificate revocation status.
Read original source ↗ - Simon Willison · Oct 21, 07:50Private keys of eight eMudhra intermediate CA certificates compromised, affecting major browser trust stores
The private keys of eight eMudhra intermediate CA certificates have been compromised, allowing them to chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Any software bundling trusted certificate lists must be updated. New versions of uv, pip and certifi include upgraded certificate lists to mitigate the issue.
Read original source ↗
Different reports do not necessarily disagree. Check original sources and publication dates.
Report timeline
Explore every side through dated source reports.
- CointelegraphTech giants block eight eMudhra certificates to prevent fake websites
Major tech companies including Mozilla, Cloudflare, and browser developers have deployed emergency blocks against eight intermediate certificates issued by India-based eMudhra Limited. The certificates were found to have insufficiently secure private keys, making them vulnerable to exploitation. Mozilla confirmed the key-generation process was "flawed" and "trivial to exploit," allowing attackers to impersonate legitimate websites. While browser vendors have issued protections, systems that do not receive automatic updates remain at risk.
- CoinDeskeMudhra certificate authority private keys cracked, browsers block forged certificates
Eight private keys belonging to Indian certificate authority eMudhra were compromised due to the use of easily guessed small integers, allowing researchers to recover all keys from public certificates in under a second. Major browser makers including Mozilla, Chrome, Apple, and Microsoft have blocked the affected certificates, but non-browser software such as Python, Node, and Go runtimes may remain vulnerable as they often do not check certificate revocation status.
- Simon WillisonSelectedPrivate keys of eight eMudhra intermediate CA certificates compromised, affecting major browser trust stores
The private keys of eight eMudhra intermediate CA certificates have been compromised, allowing them to chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Any software bundling trusted certificate lists must be updated. New versions of uv, pip and certifi include upgraded certificate lists to mitigate the issue.