Mozilla has blocked eight intermediate digital certificates linked to Indian digital-trust company eMudhra after their private keys were reportedly compromised. The incident raised concerns about the possibility of attackers creating fraudulent HTTPS certificates that could make fake websites appear legitimate to browsers.
Mozilla said it received a report about the incident on October 17 and blocked the affected certificates for users with standard Firefox settings within three hours. The company has not reported evidence in its published account that the compromised keys were used to carry out attacks.
Why Compromised Intermediate Certificates Are a Security Risk
HTTPS certificates help browsers verify the identity of websites and establish secure connections. They play an important role in protecting activities such as online banking, shopping, email and other internet services.
These certificates are issued by trusted Certificate Authorities (CAs). At the top of the certificate system are root certificates recognised by browsers and operating systems. Intermediate certificates sit below them, allowing authorised organisations to issue website certificates without routinely using their most sensitive root keys.
Each intermediate certificate relies on a private key to create digital signatures. If an unauthorised person obtains that key, they may be able to issue fraudulent website certificates that appear trustworthy to systems accepting the affected certificate chain.
In some circumstances, an attacker who can also intercept a user’s internet connection could use a fraudulent certificate to impersonate a genuine website and potentially access or modify information passing between the user and the site.
In the eMudhra case, private keys associated with eight intermediate certificates were reportedly compromised. This created a potential security risk, although Mozilla’s published account did not establish that the certificates had been used maliciously.
How Mozilla Protected Firefox Users
Mozilla added the eight affected certificates to OneCRL, its centrally distributed certificate revocation list. The block reached Firefox users with standard configurations by 22:59 UTC on October 17. These users did not need to restart their browsers or install a manual update to receive the protection.
Mozilla also released Firefox 158.0.1 for desktop and Android, along with Firefox ESR 115.43.1 and ESR 153.5.1. These releases were intended for a smaller group of users whose customised settings might have prevented them from receiving the OneCRL update.
In addition, Mozilla updated its Network Security Services (NSS) trust store to remove the root certificate that had signed the affected intermediate certificates. This measure also helps protect other software that relies on Mozilla’s certificate store.
eMudhra’s Explanation of the Incident
eMudhra said the affected certificates were created during a key-generation ceremony in April 2025. The company’s investigation is ongoing, and it stated that its root Certificate Authority private keys and other intermediate authorities were not affected.
According to eMudhra, seven of the eight affected intermediate certificates had never been deployed in production. The remaining certificate had been deployed, but none of the eight had issued any end-entity certificates.
The company said its internal investigation and publicly available Certificate Transparency records supported these findings.
These details are important because the compromise of a certificate’s private key creates a potential risk, but does not by itself establish that fraudulent website certificates were issued or that users were attacked.
What Firefox Users and Organisations Should Do
Users with standard Firefox settings were protected automatically through Mozilla’s certificate-blocking measures. Those who use customised certificate or update settings should install the latest supported Firefox or Firefox ESR release applicable to their system.
Organisations that maintain their own certificate trust stores should review the notices published by Mozilla and eMudhra, verify that certificate revocation is handled correctly and check whether affected certificate chains are present in their systems.
The incident highlights the role of browser vendors, certificate authorities and organisations in responding quickly when digital certificate keys are compromised. Timely revocation and clear security guidance can help limit the risk posed by certificates that may no longer be trusted.
Disclaimer: This article is intended for general informational purposes only and should not be treated as cybersecurity or technical advice for a specific environment. Users and organisations should consult official Mozilla and eMudhra security notices and follow the recommendations relevant to their systems.