Current outcome
The eight affected eMudhra intermediate CAs have been emergency-blocked by major browsers, Cloudflare, and several developer language/framework ecosystems, and eMudhra has formally revoked the certificates; no evidence yet shows the weak keys were used to forge certificates, but IoT devices and unpatched legacy systems remain exposed and cleanup is ongoing.
Progress timeline
3 material updates- #01
EMudhra Intermediate CA Compromise
eMudhra's intermediate CA private keys turned out to be single-byte values, enabling trivial forgery of certificates chaining to a trusted root until browsers revoked the CAs within hours.
Source evidence: galadran
- #02
Tech giants rush to block 8 eMudhra certs that could enable fake sites
Added concrete response details: Mozilla independently recovered and confirmed the flawed keys; Cloudflare released updates for Cloudflare One, WARP Clients and Tunnel on Tuesday; Chrome blocked the certificates since Saturday, Apple since Monday, Microsoft since Tuesday; Firefox released Desktop and Android updates for users with custom settings. The report also says major browsers show no evidence of exploitation, certificate transparency logs have no entries for the intermediate CAs since April 2025, and non-browser clients that do not enforce CT remain at risk.
State after update: The eight affected eMudhra intermediate CAs have been emergency-blocked or mitigated by major browsers and Cloudflare; major browsers show no evidence of exploitation, but non-browser clients that do not enforce Certificate Transparency may remain exposed to forged certificates.
Source evidence: Cointelegraph
- #03
印度CA机构eMudhra曝私钥生成漏洞，全球浏览器紧急拉黑防范中间人攻击
Added that eMudhra has formally revoked the defective certificates and that major developer ecosystems including Go, Python, Rust, and Electron have pushed updates to block the affected certificates within their own trust stores.
State after update: The eight affected eMudhra intermediate CAs have been emergency-blocked by major browsers, Cloudflare, and several developer language/framework ecosystems, and eMudhra has formally revoked the certificates; no evidence yet shows the weak keys were used to forge certificates, but IoT devices and unpatched legacy systems remain exposed and cleanup is ongoing.
Source evidence: theblockbeats