Mozilla is urging operators of certificate trust stores to block eight eMudhra Limited intermediates where possible, warning that software without effective revocation checks may still accept forged certificates.
Trust stores tell software which certificate issuers to accept. Mozilla said operators unable to block individual intermediates should evaluate removing the roots that signed them. Clients that reliably check revocation and reject certificates when those checks fail need no additional action. Removing a root can also disrupt legitimate websites, Mozilla said.
Mozilla said each of the eight certificates exposed enough information to reconstruct its signing key. Six supported website certificates and two supported code signing; a researcher reported the issue Oct. 17. Mozilla said someone intercepting a connection could use a forged website certificate to impersonate a site and read or alter traffic.
Chrome blocked the six website intermediates Oct. 17. Firefox’s block reached users with standard settings that day; Mozilla released software updates Oct. 20 for users whose configurations might have prevented delivery. Google said it found no website certificates tied to the six intermediates in Certificate Transparency logs before Chrome’s block, so Chrome’s default logging policy would have rejected them. That finding does not establish whether other software encountered unlogged certificates.
eMudhra’s initial account identifies an April 30, 2025, key-generation operation as the source of the weak keys, saying staff used keys from a separate generated set. The company said its root private keys were unaffected and the eight intermediates issued no end-entity certificates. Its investigation into the cause continues.
Mozilla has released Network Security Services (NSS) 3.131.1, which removed trust in emSign ECC Root CA - G3 from a certificate list used by other applications. Website operators whose certificates depend on a removed root may need replacements. eMudhra said it is helping affected customers obtain them.
Google warned that some legitimate certificates tied to the root will stop working in Chrome. Its previously announced Chrome Root Store removal is expected to reach devices relying on that store Oct. 27, after earlier delivery through prerelease channels.
