Key points
- eMudhra voluntarily withdrew from the global certificate business after eight intermediate certificate private keys were found to be weak.
- Major browsers including Firefox, Apple, and Chrome blocked the affected certificates due to the risk of fraudulent HTTPS issuance.
- Researcher Scott Helme revealed that one private key was the number four, instead of a random 384-bit number.
An Indian root certificate authority has exited the global certificate business after a security flaw allowed attackers to potentially forge digital identities for any website. This decision follows the discovery that eight intermediate certificates possessed critically weak private keys, leading major web browsers to block them to protect users from impersonation attacks.
How it unfolded
- In April 2025, eMudhra conducted a ceremony to create certificates, but a procedural flaw resulted in weak private keys.
- The issue remained undetected for 18 months and survived two independent audits before researcher Scott Helme reverse-engineered the keys.
- Helme published findings showing one key was simply the number four, while others were 56 and 115, instead of random numbers.
- Google, Mozilla, and others confirmed the keys allowed attackers to issue fraudulent certificates, prompting browser blocks.
Who is affected
Users of Firefox, Apple devices, and Chrome browsers were protected when these platforms blocked the compromised certificates. According to Cloudflare, the certificates were widely trusted by their system and operating systems, meaning the weak keys could have allowed any attacker to create forged certificates for any domain. This would enable impersonation of servers to intercept or modify user traffic.
What happens next
eMudhra chairman V. Srinivasan stated the company revoked the affected certificates within 14 hours of discovery and claimed no data breaches occurred. India’s Ministry of Electronics and IT is investigating the incident but defended the company against social media fear-mongering. CERT-IN warned that exploiting these keys could facilitate credential theft, sensitive data exposure, and financial fraud by allowing malicious software to appear digitally signed by a trusted publisher.
The background in plain language
Digital certificates act like IDs for websites, proving they are who they claim to be. Private keys are the secret passwords used to create these IDs. If a private key is weak or simple, anyone can guess it and create fake IDs. This allows attackers to pretend to be real websites, stealing passwords or installing malware. Teams usually check for these weaknesses during audits, and browsers block known bad certificates to keep users safe from impersonation.
What to do and how to stay safe: eMudhra
- Check your organization's certificate inventory to ensure no eMudhra-issued intermediate certificates are currently in use.
- Monitor browser logs for connection errors related to blocked certificates, which may indicate exposure to the compromised keys.
- Verify that your security tools are updated to recognize the revoked certificates as untrusted.
- Review internal policies for certificate procurement to ensure vendors follow strict key generation standards.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why was the private key being the number four a problem?
Private keys must be complex random numbers to be secure; using a simple number like four makes them easy to guess and forge.
Did eMudhra confirm any data was stolen?
No, eMudhra chairman V. Srinivasan claimed there were no compromises or data breaches resulting from the incident.
Which browsers blocked the affected certificates?
Firefox, Apple, and Chrome blocked the certificates after Google, Mozilla, and others confirmed the security risk.
