Mozilla Blocks eMudhra Certificates Over Security Risks
Mozilla has revoked eight intermediate certificates following the compromise of their associated private keys.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust your web browser to protect you from fraudulent website impersonation attacks?
Mozilla is blocking eight eMudhra intermediate certificates after confirming that their private keys were compromised. This action prevents the potential issuance of fraudulent HTTPS certificates by unauthorized parties.
Why it matters
Compromised private keys pose a significant security risk, as they allow attackers to issue malicious HTTPS certificates that could deceive users. Revoking these certificates is a critical step in maintaining the integrity of secure web communication.
Mozilla added the affected certificates to its OneCRL centralized revocation list and updated the trusted list within Network Security Services version 3.131.1.
The players
Mozilla
Mozilla is a global non-profit organization dedicated to keeping the internet open and accessible through its development of the Firefox web browser.
eMudhra
eMudhra is an international certification authority that provides digital identity and trust solutions for secure electronic transactions.
NetBSD Foundation
The NetBSD Foundation is the non-profit organization responsible for overseeing the development and support of the free, secure Unix-like NetBSD operating system.
The details
The security measure follows a coordinated response from major browser developers to mitigate risks stemming from the eMudhra key compromise. In addition to browser-level blocks, the NetBSD Foundation has provided guidance for system administrators to manually block the affected certificates.
Timeline
Chrome blocked the compromised certificates on October 17, 2026.
Apple devices blocked the compromised certificates on October 19, 2026.
Mozilla and Microsoft implemented blocks on October 20, 2026.
The Tech Race
This response highlights the ongoing reliance on centralized revocation systems to maintain web trust when certificate authorities face security lapses. It underscores the continuous arms race between security providers and attackers aiming to undermine the HTTPS infrastructure.
Most users will remain protected automatically through browser updates that incorporate these security blocks. No manual user action is required to maintain a secure connection, as the software now prevents the use of the compromised credentials.
The takeaway
Maintaining web security requires constant coordination between major technology providers when underlying infrastructure components fail. Users should ensure their browser software is always updated to the latest version to receive critical security patches.
Further reading
For more information on how browser developers manage digital trust, visit the Cybersecurity section.
Live Poll
Do you trust your web browser to protect you from fraudulent website impersonation attacks?
