Eight eMudhra certificate authority keys compromised: What to know

Weakly generated keys could allow website impersonation; browser and software providers have moved to block them

The private keys associated with eight digital security certificates issued by eMudhra, an Indian digital trust company, have been compromised, prompting browser and software providers to block the affected certificates.

 

The weakly generated keys could allow attackers to create fake website certificates and impersonate legitimate websites, potentially enabling them to intercept or alter information exchanged between users and servers, according to Google's Chrome Root Program. However, the cited reporting shows no confirmed evidence that the compromised keys were used to carry out such attacks.

 

Google Chrome and Mozilla Firefox blocked the affected certificates after the compromise was reported on October 17. Apple, Microsoft and other software providers also took action. eMudhra said it was investigating the incident and working with browser and software providers to contain the risk.

 

What does eMudhra do?

eMudhra is a licensed Certifying Authority under the Information Technology Act, 2000. It issues Digital Signature Certificates and provides website security certificates, electronic signing platforms and digital identity services.

 

Certifying Authorities issue digital certificates that help browsers verify website identities and establish secure connections. These certificates are also used to authenticate electronic signatures and verify digitally signed software. 

Why this matters

According to Google's Chrome Root Program, the eight private keys were generated with insufficient randomness, making them vulnerable to recovery and misuse.

 

Six affected certificates were intended for website security, while the other two were for code signing. If misused, the keys could allow attackers to create certificates that make fraudulent websites appear legitimate to systems that still trust them.

 

The Hacker News reported that no website certificates linked to the six affected certificates appeared in Certificate Transparency logs before Chrome blocked them. These logs publicly record website certificate issuance and help researchers identify suspicious activity.

Security response

Chrome and Firefox blocked the affected certificates on October 17. Apple followed on October 19 and Microsoft on October 20, according to The Hacker News. The Go programming language project also released security updates, while Cloudflare deployed mitigations across its services.

 

Google separately announced plans to remove the emSign ECC Root CA - G3 certificate from Chrome's root store, with the change expected to reach supported devices on October 27. Google warned that some legitimate websites relying on certificates linked to this root could stop working in Chrome.

What has eMudhra said?

In a statement, eMudhra said the affected certificates were created during a key generation ceremony in April 2025.

 

“The incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs,” the company said.

 

eMudhra said one affected intermediate certificate had been deployed in production, but none had issued certificates to end users, websites or other entities. It said it had initiated incident response procedures and was reviewing its security controls.

 

Cloudflare said it had not identified active exploitation on its own services. The investigation into the compromise remains ongoing.