Tech companies block eMudhra certificates after weak keys expose intermediate authorities
Major browser developers and technology firms have moved to block eight intermediate certificate authorities from Indian issuer eMudhra after flaws revealed dangerously weak private key sizes of just 3 to 8 bits.
Major web browsers and operating system developers have blocked eight intermediate Transport Layer Security (TLS) certificates issued by Indian certification authority eMudhra after researchers uncovered severe key generation flaws. According to reporting by Dan Goodin for Ars Technica, the intermediate certificates relied on private keys measuring only 3 to 8 bits—dramatically smaller than the typical numbers used in cryptography, which usually span roughly 116 digits. The extreme weakness made the keys easily recoverable, with reported secret values as small as 4, 56, and 115, leaving the keys open to being guessed by anyone.[1][2][3][11][13]
Because intermediate certificates vouch for the authenticity of websites, attackers possessing the compromised private keys could potentially forge trusted HTTPS certificates for any domain and impersonate legitimate services. In response, Google, Apple, Microsoft, and Mozilla deployed emergency mitigations to stop trusting the certificates. Bengaluru-headquartered eMudhra has since revoked all eight affected certificates and issued a public apology, though commentators noted that updating older, embedded, and legacy devices could pose a prolonged operational challenge.[2][3][4][5][10][11][14][15]
The incident drew an advisory from the Indian Computer Emergency Response Team (CERT-In) as well as scrutiny from industry observers and government bodies. While tech professionals cited by Business Today condemned the blunder as gross negligence, eMudhra stated it found no evidence of an external cyberattack or data breach, classifying the problem as a technical flaw. A co-founder told the Economic Times that the vulnerable keys were created but never put to commercial use. Meanwhile, BusinessLine reported that India's Ministry of Electronics and Information Technology (MeitY) has initiated an investigation through a special team and is exploring domestic audit options to lessen reliance on overseas providers.[4][6][7][8][9][12][16][17]
Key facts
- Eight intermediate TLS certificates issued by eMudhra had weak private key sizes of just 3 to 8 bits, making them easily recoverable.
- The flaw would allow an attacker holding the keys to forge trusted HTTPS certificates for any website.
- Apple, Google, Microsoft, and Mozilla have blocked the affected eMudhra certificates across their platforms.
- eMudhra revoked all eight affected certificates, issued a public apology, and stated it found no evidence of a data breach or cyberattack.
- An eMudhra co-founder stated that the vulnerable keys were created but never put to commercial use.
- The Computer Emergency Response Team, India (CERT-In) issued an advisory regarding the key exposure.
- India's Ministry of Electronics and Information Technology (MeitY) convened a special team to investigate and is exploring domestic audit options.
Sources · 13 sources
- TE
TechmemeArticle ·
Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them (Dan Goodin/Ars Technica) Dan Goodin / Ars Technica : Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them — Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys …
Open source - CT
Coin TelegraphArticle ·
Tech giants rush to block 8 eMudhra certs that could enable fake sites A private key generation flaw allowed anyone to guess them and forge HTTPS certificates for any website.
Open source - BT
Bull Theory@BullTheoryioPost on X ·
BREAKING: Security teams around the world are on high alert after 8 internet security certificates were found broken. Every secure website proves its identity with a digital certificate. Certificate authorities issue them, and browsers trust those authorities by default. eMudhra, which says it has issued over 60 million certificates, had private keys for 8 of its certificates compromised. One key was just "4". With these keys, an attacker can forge a trusted certificate for any website. But fixes are already rolling out. eMudhra has revoked all 8 certificates, and Firefox, Apple and Microsoft have shipped protection, while some software is still waiting for updates.
Open source - MI
Mint@livemintPost on X ·
A cybersecurity flaw at eMudhra exposed eight digital certificates with weak private keys, raising concerns about online security. Google, Apple, Microsoft and Mozilla blocked the affected certificates, while eMudhra revoked all eight. The company said it found no evidence of a cyberattack or data breach linked to the flaw. Watch! https://t.co/kVivgyy9hv
Open source - DI
Digit@digitindiaPost on X ·
🚨 Weak cryptographic keys exposed 8 intermediate CAs linked to eMudhra, sparking a public apology. 😳 What went wrong? And what did eMudhra say? 👇 https://t.co/1W6W98FTzW #CyberSecurity #eMudhra #InfoSec
Open source - ET
Economic Times@EconomicTimesPost on X ·
Vulnerable keys were created but never put to commercial use, investigation on: eMudhra cofounder https://t.co/wsCT4zzEPs
Open source - BU
businessline@businesslinePost on X ·
Cybersecurity | After eMudhra certificate keys were compromised, MeitY is exploring Indian audit firms to reduce reliance on overseas providers. A special team is investigating. https://t.co/4rPjeA5F4O
Open source - BT
Business Today@business_todayPost on X ·
#TechToday | 'Gross negligence, unforgivable': eMudhra faces fury over security lapse, techies question leadership https://t.co/wxZuizcAMM
Open source - MI
Mint@livemintPost on X ·
#MintPrimer | India’s only certificate issuer trusted by browsers worldwide, eMudhra, is under scrutiny after a researcher found weak security keys in its website certificates. The company calls it a technical flaw, not a breach. https://t.co/HvwaD2YvbV Trust our hard work, subscribe to #MintPremium: https://t.co/Qg3AmYxkGV⚡️ By @distantvicinity
Open source - TH
Tom's Hardware@tomshardwarePost on X ·
Leaked private keys for eight CA certificates let any attacker impersonate any domain https://t.co/2Dd7ax7d9V
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
🇮🇳 Your BANK, your email, practically ANY website could have been impersonated, with your browser none the wiser. All thanks to one company's INSANE security blunder. Indian company eMudhra, trusted to certify that websites are genuine, used EIGHT cryptographic keys so ridiculously weak they could be cracked almost instantly. How weak? A normal key relies on a secret number roughly 116 digits long. eMudhra's secret numbers? Just 4, 56 and 237. These are NOT pieces of the keys. They were the ACTUAL numbers! 🤯 Anyone with those keys could have forged trusted certificates for virtually any website, potentially fooling your browser if they intercepted your connection. Major browsers have already blocked the keys, and there's no confirmed malicious use so far. But cleaning up older devices and software could be a nightmare. An expert warns it could be bigger than Heartbleed, the infamous 2014 security disaster that took years to fix, because millions of old devices and systems still need updating. And here we are, being told our passwords need another capital letter and a special character. Source: Ars Technica / Writer: Julie
Open source - BU
businessline@businesslinePost on X ·
eMudhra issue: Government looking at domestic alternatives @ronendrasingh https://t.co/XAhYcTg09s
Open source - TE
Techmeme@TechmemePost on X ·
Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them (@dangoodin001 / Ars Technica) (Visit Techmeme dot com for the link and full context!)
Open source - TH
The Hindu@the_hinduPost on X ·
Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd. have been leaked, sending security teams at major internet browser and operating system developers around the world scrambling to patch their systems to stop trusting the affected certificates. ✍️ @AroonDeep https://t.co/MdoE57Omgy
Open source - EE
eeNews Europe@eeNewsEuropePost on X ·
Two major security incidents, two different threats to internet infrastructure. Eight intermediate certificate authority keys belonging to eMudhra were found to be easily recoverable, potentially allowing attackers to forge trusted certificates. Meanwhile, critical PHP2Shell vulnerabilities could enable attackers to execute malicious code on web servers without authentication. Major browsers have already blocked the affected certificates, while emergency PHP security updates were released on October 21. But what about embedded devices and systems that don't receive regular security updates? These incidents highlight why certificate management, software maintenance, and timely security patches matter. Read more on eeNews Europe: https://t.co/QZSW6cMVys
Open source - TH
The Hindu@the_hinduPost on X ·
eMudhra, an Indian digital certification authority, has revealed that eight private keys associated with its certificates have been compromised. The shocking disclosure about eMudhra, whose digital certificates help browsers confirm that a website is genuine, came after an advisory from the cybersecurity watchdog CERT-In (Indian Computer Emergency Response Team). https://t.co/hRaOJLOlh2
Open source - TH
The Hindu@the_hinduPost on X ·
Explained | Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. ✍️@AroonDeep https://t.co/gWKJSSIbu1
Open source - BT
Business Today@business_todayPost on X ·
#TechToday | Major security flaw triggers action from Google and Apple against eMudhra certificates https://t.co/O6qM9DuCgK
Open source