Private keys associated with eight eMudhra intermediate certificates were compromised, prompting emergency browser protections. Mozilla says it received the report on October 17 and completed its Firefox block in less than three hours.
A certificate authority, or CA, signs certificates that help software verify a website's identity. An intermediate CA sits between a trusted root and certificates issued below it. Control of its private signing key can undermine that chain.
Mozilla says the affected keys could let someone issue fraudulent HTTPS certificates for websites they do not control. Reading or modifying a connection would additionally require an attacker able to intercept that connection. Possessing a signing key does not automatically reveal every encrypted session.
The description of this incident needs care. Mozilla's public Bugzilla record says its engineers independently recovered the keys and found the key-generation process flawed. That establishes compromise; it does not establish that someone stole the keys from eMudhra's servers.
In its response on that record, eMudhra attributed the problem to a script used during a key-generation ceremony. The company described a second set of weak keys that was mistakenly selected. That account remains the company's explanation of the cause.
In its updated public statement, eMudhra says the affected intermediates issued no end-entity certificates and its infrastructure was not compromised. Those are the company's findings, while its root-cause investigation remains open.
Firefox distributed the block through OneCRL, its centrally updated revocation list. Mozilla says standard installations received that protection without an update or restart. Separate Firefox and NSS releases extended protection to other configurations and software using its trust data.
The incident also appears in Red Hat's guidance under CVE-2026-111943. Browser protection and an updated server or application trust store are separate delivery paths. The trust chain extends beyond the browser.
