Eight intermediate certificate authority keys linked to eMudhra’s global website-security business were found to be dangerously weak, raising concerns about the systems that browsers use to establish trust online.

The flaw could have enabled attackers to create fraudulent HTTPS certificates and impersonate legitimate websites. The keys were generated on April 30, 2025, but the weakness remained undetected for about 18 months, according to eMudhra’s statement on October 21, 2026.

A certificate authority (CA) verifies identities and issues digital certificates. Intermediate authorities operate under a root certificate trusted by browsers and operating systems.

eMudhra said a key-wrap/unwrap step during its key-generation procedure produced a second, weak set of keys, which were subsequently published to browser root stores. Although the company added its root private key was not compromised, browser operators have withdrawn trust from the associated emSign ECC Root CA - G3 as a precaution.

Google’s Chrome Security team warned that the flaw was “enabling anyone to forge trusted HTTPS certificates to impersonate any website against clients that have not yet removed trust in those CAs.” Google blocked the affected keys and plans to remove the parent root from Chrome’s trust store from October 27, Pacific time. Some legitimate websites using certificates under that root may consequently stop functioning in Chrome.

Mozilla, meanwhile, blocked the affected certificates in Firefox within three hours of receiving the report and released software updates to extend protection to users who might not receive automatic safeguards.

eMudhra said none of the eight affected intermediate authorities issued end-user certificates, its infrastructure was not compromised and no data was breached.

Source link