Mozilla drops an eMudhra root because keys for 8 of its CAs are recoverable

The private keys of eight eMudhra intermediate CA certificates were generated so weakly that anyone can recover them from the certificates, Mozilla says. Six issue TLS certificates and chain to roots trusted by Mozilla, Google, Microsoft and Apple. Chrome and Firefox have blocked them since Oct 17, but software that doesn’t get revocation updates still trusts them. On Oct 20 Mozilla removed eMudhra’s ECC root from NSS, and Google said Chrome’s root store will follow.

Affected: Software that trusts emSign ECC Root CA - G3 or Sectigo’s AAA Certificate Services root and doesn’t get revocation updates. All versions and fixes
CVE
Vendors: eMudhra, Mozilla, Google, Cloudflare
Published: Oct 21, 6:00 a.m. ET
Editor: Austin Simas

Details

eMudhra created the eight keys in one key ceremony on Apr 30, 2025. Mozilla found that each P-384 private key is a number below 256, so it can be recovered almost instantly. The CA says a flaw in the script used that day made a second set of weak keys, which were used by mistake because their labels were similar. It says its RSA issuers and its other CAs aren’t affected, and it will recheck every key ceremony.

Six of the certificates are for TLS. The other two are for code signing and trusted by Microsoft. Sectigo had cross-signed some of them and revoked those cross-certificates on Oct 19. According to eMudhra, one of the CAs went into production, but none issued end-entity certificates. Google says none of the six TLS CAs’ certificates reached certificate transparency logs before its Oct 17 block. So Chrome and other browsers that require those logs couldn’t have trusted a forged one.

Many clients outside the browsers don’t check those logs or get revocation updates. An incident site run by Mozilla’s Dennis Jackson says the keys could have been recovered since the certificates were created. It says it isn’t known whether attackers used them against such clients. Mozilla says several people have since recovered the keys on their own, and some posted them.

Firefox has blocked the certificates through OneCRL since Oct 17, and Chrome has blocked the six TLS CAs through CRLSet. The incident site says Apple devices have blocked them since Oct 19 and Microsoft platforms since Oct 20. Go’s fix, tracked as , makes its crypto/x509 package filter out chains that contain the compromised intermediates. On Oct 20, eMudhra stopped issuing from every CA under its ECC root. It says about 30,000 certificates must move to CAs under its RSA root, which Mozilla still trusts.

What to do

7 steps

1Update operating systems and container base images to the patched ca-certificates packages the incident site lists, and rebuild images that bundle a trust store.
2Upgrade Go to 1.27.3 or 1.26.10, NSS to 3.131.1 and Python’s certifi to 2026.10.19, then rebuild and restart the applications that use them.
3Update Cloudflare One Client, the 1.1.1[.]1 app and cloudflared to the versions Cloudflare lists, redeploying cloudflared container images with the fixed image.
4Check applications with their own trust store, since Cloudflare says an SDK update may not change the library, runtime or operating system that checks certificates.
5Test each application through its own TLS path with the incident site’s test hosts, where a certificate error means it no longer trusts the compromised CAs.
6Move server certificates that chain to emSign ECC Root CA - G3 to another chain, since Mozilla says clients using its updated trust store will reject them.
7Don’t clear new certificate errors by turning off verification, which Cloudflare says would remove the protection these updates restore.

Affected and fixed versions

Product	Affected	Fixed
NSS	Before `3.131.1`	`3.131.1`, which removes the eMudhra root
Firefox	Protected through OneCRL since Oct 17, unless settings block its updates	`158.0.1`, or ESR `115.43.1` or `153.5.1`
Go	Before `1.26.10`, and `1.27.0` through `1.27.2`	`1.26.10` or `1.27.3`
Python certifi	Earlier releases	`2026.10.19`
Cloudflare One Client	Earlier versions	Android `2.5.7`, iOS `1.12.7`, and `2026.8.2115.0` for Windows, macOS and Linux
Cloudflare 1.1.1[.]1 app	Earlier versions	Android `6.38.11`, iOS `6.31.8`, and `2026.8.2115.0` for Windows, macOS and Linux
cloudflared	Before `2026.10.2`	`2026.10.2`
Chrome	Protected through CRLSet since Oct 17	No action needed

Product
NSS
Affected
Before 3.131.1
Fixed
3.131.1, which removes the eMudhra root
Product
Firefox
Affected
Protected through OneCRL since Oct 17, unless settings block its updates
Fixed
158.0.1, or ESR 115.43.1 or 153.5.1
Product
Go
Affected
Before 1.26.10, and 1.27.0 through 1.27.2
Fixed
1.26.10 or 1.27.3
Product
Python certifi
Affected
Earlier releases
Fixed
2026.10.19
Product
Cloudflare One Client
Affected
Earlier versions
Fixed
Android 2.5.7, iOS 1.12.7, and 2026.8.2115.0 for Windows, macOS and Linux
Product
Cloudflare 1.1.1[.]1 app
Affected
Earlier versions
Fixed
Android 6.38.11, iOS 6.31.8, and 2026.8.2115.0 for Windows, macOS and Linux
Product
cloudflared
Affected
Before 2026.10.2
Fixed
2026.10.2
Product
Chrome
Affected
Protected through CRLSet since Oct 17
Fixed
No action needed

Timeline

Apr 30, 2025eMudhra generates the keys for the eight CA certificates in one key ceremony.
Oct 17A researcher reports the keys, and Chrome and Firefox block the six TLS CAs.
Oct 18eMudhra revokes the eight certificates.
Oct 19Sectigo revokes its cross-certificates, and Mozilla starts telling other trust store operators.
Oct 20Mozilla discloses the incident and removes eMudhra’s ECC root from NSS, and Google says Chrome will follow.

Sources

Mozilla Security BlogPrimary source blog.mozilla.org
Mozilla dev-security-policy forumPrimary source groups.google.com
Mozilla Bugzilla incident reportPrimary source bugzilla.mozilla.org
eMudhra intermediate CA compromise sitePrimary source emudhra.we-have-a-problem.com
CloudflarePrimary source blog.cloudflare.com
Go announcementPrimary source groups.google.com