Mozilla, Google, Apple block compromised eMudhra CA certificates

Certificate authority eMudhra has revoked eight intermediate TLS certificates after a researcher found their private keys were generated with such a narrow range of possible values that anyone could brute-force them in roughly 256 attempts. eMudhra traced the flaw to a scripting error from April 2025 that produced a weaker, mislabeled set of keys that got used for signing instead of the properly generated ones. The company says most of these intermediates were never put into production and it has no evidence end-user certificates were issued or that the keys were actually abused, though the exposure window has existed since last April. Mozilla, Google Chrome, and Apple have all pushed out blocks for the compromised certificates via their respective revocation mechanisms, Mozilla additionally shipping Firefox 158.0.1 and ESR updates for users whose setups missed the earlier OneCRL fix, while the Go team addressed the issue as CVE-2026-111943 in releases 1.27.3 and 1.26.10. Because some certificate stores don't check revocation status, including macOS's built-in curl tool, users and administrators are urged to apply the latest updates across affected software, Linux distributions, and language ecosystems to fully stop trusting the vulnerable certificates.