Tech Giants Block Vulnerable Digital Certificates to Prevent Website Impersonation

On Tuesday, browser developers and major tech companies implemented defenses against eight intermediate certificates issued by the Indian certificate authority eMudhra Limited, after discovering that their private keys lacked sufficient security.

Dennis Jackson, a cryptography engineer at Mozilla, reported that Mozilla independently recovered the private keys after being notified of the vulnerability on Saturday, confirming that the key generation process was flawed and easily exploitable.

According to Mozilla, an attacker intercepting a user's connection could exploit the fake certificates to impersonate legitimate websites, potentially accessing or altering sensitive information exchanged during browsing.

Although many companies quickly blocked the affected certificates, risks persist for apps and systems that do not automatically receive these certificate blocks.

Mozilla Firefox's security team stated in a Tuesday blog post that they acted promptly upon receiving the report on Saturday, blocking the certificates in Firefox through OneCRL the same day, followed by updates for Desktop and Android browsers to protect users with customized settings preventing automatic OneCRL updates.

Cloudflare announced discovering the issue on Monday and on Tuesday released updates for their Cloudflare One, WARP clients, and Cloudflare Tunnel services while applying additional protective measures across their platform.

Jackson noted that similar blocks were implemented in Chrome starting Saturday, on Apple devices from Monday, and across Microsoft platforms since Tuesday.

He explained the issue was responsibly disclosed to trust store maintainers on October 19, with many having already released or preparing to release fixes.

Jackson emphasized there is no evidence of attacks targeting Firefox, Chrome, Edge, or Safari, as no certificate transparency logs have recorded activity involving these intermediate certificates since April 2025.

However, he cautioned that numerous clients outside mainstream browsers do not enforce Certificate Transparency standards, leaving uncertainty around whether attackers exploited the vulnerability against such systems.

This event echoes the 2011 DigiNotar breach, where hackers compromised the Dutch certificate authority, issuing over 500 fraudulent SSL certificates.

Those rogue certificates enabled attackers to impersonate Google and conduct surveillance on roughly 300,000 Gmail accounts in Iran.

This incident highlights ongoing vulnerabilities in digital certificate security, emphasizing the critical need for vigilant key management and swift coordinated responses among technology providers to protect internet users from impersonation attacks.