Key points
- eMudhra will cease issuing SSL/TLS certificates after researchers reconstructed eight weak private keys in under a second.
- Major browsers including Chrome, Firefox, Apple, and Microsoft blocked the compromised certificates following the disclosure.
- The company cited rising compliance costs and competition from free certificate providers as additional reasons for exiting the business.
Indian certificate authority eMudhra announced it will stop issuing SSL/TLS certificates after security researchers demonstrated that the private keys protecting eight of its intermediate certificates were so weak they could be reconstructed in less than a second.
How it unfolded
- Last week, a researcher alerted Apple, Google, Microsoft, and Mozilla that eight eMudhra intermediate certificate private keys could be computed from public data due to insufficient randomness.
- Security researcher Scott Helme recovered all eight keys on a laptop in under a second, a process later repeated by an AI agent from a single prompt.
- Chrome and Firefox blocked the certificates within hours of the report, while Apple blocked them on Monday and Microsoft on Tuesday.
- eMudhra announced on Thursday that it would stop issuing certificates, closing the incident that triggered the browser blocks and an investigation by Indian authorities.
Who is affected
eMudhra stated that its infrastructure was not compromised and that no data was breached during this incident. The company confirmed that none of the eight intermediate certificates with weak keys had issued any end-entity certificates to customers. Consequently, no specific websites or users are known to have had their identities forged using these particular flawed keys.
The impact was primarily on the trust infrastructure itself. Major web browsers acted quickly to prevent the use of these specific intermediate certificates. While the eight specific keys were neutralized by browser blocks, the incident raised broader questions about the randomness generation processes used by certificate authorities to create cryptographic keys.
What happens next
eMudhra’s board concluded that leaving the certificate business was the right decision for the company and its shareholders after detailed deliberations. Chairman V. Srinivasan cited rising costs associated with data sovereignty and compliance requirements as key factors in this decision.
He also noted intense competition from large providers that issue certificates free of charge. Srinivasan added that social media amplification of the security incident brought scrutiny that was out of proportion to the unit’s place in the broader company. For many certificate authorities, SSL/TLS is the entire business, but for eMudhra, it was only one part of a wider digital solutions portfolio.
The background in plain language
Certificate authorities act as trusted third parties that verify website identities by issuing digital certificates. These certificates rely on cryptographic keys: a public key shared openly and a private key kept secret. The security depends entirely on the private key being unpredictable. If a key is generated with poor randomness, it becomes guessable. When a private key is weak, attackers can recreate it from the public information, allowing them to forge certificates and impersonate legitimate websites without detection.
What to do and how to stay safe: eMudhra
- Verify that your organization’s browsers are updated to the latest versions to ensure they block known compromised intermediate certificates.
- Check your internal certificate inventory to confirm you are not relying on intermediate certificates issued by eMudhra during the affected period.
- Monitor browser console logs for any unexpected certificate errors or warnings that might indicate a trust chain issue.
- Review your key generation procedures to ensure they use cryptographically secure random number generators with sufficient entropy.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did eMudhra confirm that any customer data was stolen?
No, eMudhra stated that its infrastructure was not compromised and that no data was breached.
Were any websites actually impersonated using these weak keys?
It is not known whether anyone used the keys in question, but eMudhra confirmed none of the eight intermediates issued end-entity certificates.
Why did eMudhra decide to stop issuing certificates entirely?
The company cited rising compliance costs, competition from free providers, and disproportionate scrutiny from social media amplification of the incident.
