Isophoric News · Tuesday, October 27, 2026
Apple, Google, Mozilla and Microsoft blocked eMudhra certificates after a researcher reported that eight intermediate keys could be recovered from the public certificates
Eight private keys belonging to intermediate certificates of eMudhra, an India-based certificate authority, were so weak that they could be recovered from the public certificates, according to Help Net Security and The Next Web. A researcher credited as Wayne reported the problem on Oct. 17, and Mozilla's Dennis Jackson made it public on Oct. 20, according to Help Net Security. The Next Web reported that Chrome and Firefox blocked the website-use certificates on the day of the report, Microsoft on Oct. 20, and Apple on Oct. 19; MacRumors, citing an Apple support document, reported the same Apple date and said the block applies in Safari, Mail and apps using Apple's networking frameworks with no update needed. MacRumors said there is currently no evidence the keys were exploited, while Help Net Security said it is not known whether anyone recovered and used them in the 17 months before the report. The Next Web reported Google's statement that no website certificate chaining to the six website-use certificates it had blocked had been logged in Certificate Transparency. MacRumors said one exception remains: some macOS command-line tools can still accept the certificates until Apple releases a macOS update, and Apple has given no date. The Next Web said many programs outside browsers keep trusting such certificates until their software or root lists are updated, and that Chrome planned to remove the related eMudhra root on Oct. 27. eMudhra said a flaw in a key generation ceremony in April 2025 produced a second, weaker set of keys that was the set published, according to The Next Web, and Help Net Security reported that on Oct. 22 the company said it would leave the global SSL/TLS certificate business.