Browsers Block Compromised eMudhra Security Certificates
Mozilla and other vendors are revoking trust in eight certificates to prevent the issuance of fraudulent HTTPS credentials.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust your web browser to protect you from fraudulent website impersonation attacks?
Mozilla has blocked eight eMudhra intermediate certificates following the compromise of their private keys. The move, implemented via an update to the Network Security Services (NSS) version 3.131.1, removes trust for these certificates to prevent the issuance of fraudulent HTTPS credentials.
Why it matters
When private keys for intermediate certificates are compromised, attackers gain the ability to issue fake, trusted HTTPS certificates for any website. Blocking these keys is a necessary security measure to prevent man-in-the-middle attacks and maintain the integrity of encrypted web traffic.
Mozilla updated the trusted certificate list within NSS version 3.131.1 to invalidate the 8 compromised eMudhra intermediate keys. This centralized revocation through OneCRL ensures browsers reject these specific cryptographic signatures.
The players
Mozilla
Developer of the Firefox web browser and the Network Security Services library, which maintains trust store standards.
eMudhra
A digital identity and certificate authority service provider that manages cryptographic keys for HTTPS validation.
The NetBSD Foundation
A non-profit organization that manages the development and distribution of the NetBSD operating system.
The details
Intermediate certificate authorities act as a link between root certificates and end-entity certificates used by websites to enable HTTPS. By compromising the private key, an attacker can sign fraudulent certificates that appear authentic to web browsers. Mozilla mitigates this by updating its Network Security Services (NSS) library, which governs how the browser validates cryptographic signatures, effectively blacklisting the affected keys so they can no longer establish a secure connection.
Timeline
October 17, 2026: Chrome blocked the compromised certificates.
October 19, 2026: Apple devices implemented the certificate block.
October 20, 2026: Mozilla and Microsoft completed the certificate block.
The Tech Race
This response follows the industry-standard protocol for managing certificate authority breaches established after events like the 2011 DigiNotar hack. It highlights the ongoing race between browser vendors to maintain automated, centralized revocation lists against increasingly sophisticated attacks on infrastructure providers.
Internet users are protected automatically as browser vendors and operating systems push these updates to devices worldwide. No manual user action is required to maintain secure, encrypted browsing sessions on these platforms.
The takeaway
The security of the entire web relies on the sanctity of private keys held by certificate authorities, which remain a primary target for attackers. Readers should watch for future reports regarding the scope of the original compromise to see if further certificate revocations are necessary.
Further reading
For broader trends in certificate authority security and browser trust, visit the Cybersecurity section.
Live Poll
Do you trust your web browser to protect you from fraudulent website impersonation attacks?
