Apple, Mozilla e Google bloqueiam certificados vulneráveis em seus navegadores

Apple revokes eight vulnerable certificates

Apple recently blocked eight certificates that Safari used to validate website authenticity. The certificates were issued by the Indian CA eMudhra and were found to be weak, allowing anyone to forge a legitimate site’s certificate.

Impact on major browsers

Mozilla Firefox and Google Chrome also relied on the same certificates. Mozilla disclosed that all eight used P‑384 private keys generated in April 2025, but the key values were below 256, making brute‑force recovery trivial.

• Safari (Apple)
• Firefox (Mozilla)
• Chrome (Google)

Discovery and demonstration

The flaw was first reported by a researcher known only as Wayne on 17 October. Later, another researcher, Flüpke, showcased on GitHub that the private key for the “EM OV TLS CA – G3C” certificate had a value of just 4.

eMudhra’s response

eMudhra explained that a scripting error produced a second set of weaker keys, which were mistakenly selected as the final keys due to similar labels. The authority also noted that most certificates were never used in production and found no evidence of user impact.

Potential macOS vulnerability

Mozilla’s cryptography engineer, Dennis Jackson, warned that macOS’s built‑in /usr/bin/curl may still trust the vulnerable certificates because its bundle does not check revocation status. If a Mac has already accepted one of these certificates, it will continue to trust it until a future security update.

Action taken

All three browsers have revoked the certificates. Users are advised to keep their browsers and macOS updated to ensure the revocation is respected.