Browsers Block Eight Certificates Whose Secret Keys Could Be Recovered

Cisco Talos reported Oct. 21, 2026, that the private keys behind eight of eMudhra's intermediate certificates can be recovered, and that Chrome, Mozilla, Apple and Microsoft have already blocked them. eMudhra has since revoked the certificates and stopped issuing new ones under the root they came from.

A certificate authority exists to hold a secret key nobody else can obtain: browsers trust its certificates, so they trust the websites those certificates vouch for. According to Talos, anyone holding one of these keys could impersonate any website or service, offering a connection a browser would have treated as genuine. Six of the affected certificates covered TLS, which secures web traffic; the other two were used for signing software.

Talos traced the problem to a key generation session eMudhra ran in April 2025 under its emSign G3 root. A flaw in the process created a second, weak set of keys, and eight intermediate certificates were mistakenly built from them. Talos said several of the keys evaluated to single-digit and double-digit integers rather than carrying the mandatory 384 bits of randomness. The affected certificates are listed, with their identifiers, in Mozilla's public bug report.

The response reaches past browsers. Talos said the Go team gave the certificates a vulnerability identifier, CVE-2026-111943, and shipped Go 1.27.3 and 1.26.10, which reject any chain containing one of them. Go checks certificates in its own code rather than leaving the job to the operating system, and some container environments carry built-in certificate lists that ignore revocations. Talos said other software that checks TLS certificates without consulting revocation lists may also need updates, naming VPNs as one clear case, and it recommended updating such software as vendor fixes appear.

Talos said that as of Oct. 21, 2026, it had seen no malicious use of the certificates.