Chrome and Firefox Block eMudhra Certificates Over Fake-Site Risk

Google and Mozilla moved to block certificates tied to eight weak eMudhra Limited keys after a generation flaw made it possible to forge HTTPS credentials for websites, including crypto trading sites.

The affected intermediate certificates sit between a trusted root certificate and certificates issued to individual websites. Their private keys were generated with too little randomness, allowing an attacker to create a certificate for a domain they do not control. To use one against a visitor, the attacker would also need to intercept that person's connection.

Chrome deployed a block on Oct. 17. Mozilla completed distribution of a Firefox block the same day and released browser updates for users whose custom settings might have prevented them from receiving it. Cloudflare updated its WARP clients and Tunnel software on Oct. 20.

No entries for the affected intermediate certificates appeared in certificate transparency logs since April 2025. Applications outside browsers may still trust the certificates if their underlying software or certificate stores have not been updated.