Apple blocks compromised eMudhra certificates

Apple added a revocation list for eight weak eMudhra certificates after Mozilla and Google blocked them. The certificates could let attackers forge trusted sites. The flaw was that the private keys were less than 256, making them almost instantly recoverable. Apple’s block took effect on October 19, according to a Mozilla cryptography engineer.

Weak private keys discovered

The weak keys were produced by a script error in April 2025 that chose values below 256. Security researcher Wayne discovered the problem on October 17 while scanning public certificates. eMudhra said most of the certificates were never used in production.

Mozilla blocked the eight certificates through OneCRL on October 17, protecting users without a browser update. Google Chrome blocked six of the intermediates that day, while Apple added revocation protections on October 19. Mozilla also released Firefox 158.0.1 and ESR updates on October 20 to cover users who missed the earlier revocation. Software vendors such as Go and Node.js issued updates to remove the compromised certificates from their stores.

macOS may still trust the revoked certificates because its built‑in /usr/bin/curl does not check revocation. A cryptography engineer warned that once a Mac accepts a certificate it may keep trusting it until the system is updated. Users can test their systems and apply mitigation steps on the engineer’s website.

Attackers could use recovered keys to issue fraudulent certificates that software would trust, but there is no record of such abuse so far. Apple, Google, and Mozilla will provide updates to fix the issue in browsers and operating systems. Software that uses its own certificate stores or does not check revocation may remain vulnerable until updated. Installing the latest updates ensures the compromised certificates are no longer trusted.