A prominent Indian root certificate authority has announced its departure from the worldwide certificate business in response to intense criticism over a cryptographic vulnerability discovered this week. eMudhra stated it would cease operations in the global SSL/TLS certificate sector after discovering that eight of its intermediate certificates possessed compromised private keys, leading Firefox, Apple and Chrome to revoke them.
According to assessments from Google, Mozilla and other organizations, the compromised keys could enable attackers to generate fraudulent HTTPS certificates for domains they do not own. An attacker capable of intercepting network traffic could deploy such certificates to masquerade as legitimate websites, potentially capturing or altering user communications.
Cloudflare noted that these certificates held broad trust across their infrastructure as well as in browsers and operating systems. The weakness in the keys meant that any attacker could manufacture a forged certificate for any domain and leverage it to impersonate servers, thereby intercepting or modifying traffic.
Security researcher Scott Helme brought the issue to public attention through a blog post revealing that rather than containing a random 384-bit value, one private key consisted simply of the number four. Additional keys contained only the values 56 and 115.
eMudhra attributed the problem to a procedural error that occurred during a key generation ceremony held in April 2025. The company stated that "the problem was a flaw in one step of the ceremony procedure." The flaw remained undetected for 18 months and passed through two separate independent audits before a researcher successfully reverse engineered the weak keys.
eMudhra's chairman V. Srinivasan announced on Thursday that the company revoked the compromised certificates within 14 hours of their discovery. He asserted that no unauthorized access or data breaches resulted from the incident.
India's Ministry of Electronics and IT initiated an investigation into the matter while simultaneously defending eMudhra, contending that "some social media accounts are indulging in fear mongering about the impact of this incident."
CERT-IN issued its own warning stating that someone exploiting the compromised private keys could "potentially impersonate legitimate websites or intercept or modify data exchanged between users and servers, potentially facilitating credential theft, sensitive data exposure and financial fraud." The organization further cautioned that the capacity to create fraudulent certificates would permit malicious code to appear as though it were digitally signed by a legitimate publisher.
Withdrawing
In announcing the company's exit from the certificate business, Srinivasan noted that the division represented merely 1% of eMudhra's overall revenue but had become progressively more expensive to maintain owing to regulatory obligations and "complexity." He attributed heightened attention to the company to "social media amplification." eMudhra pledged to collaborate with browser programs and clients to facilitate their transition to alternative providers.
The company stated: "Revocation and certificate status services will keep running until every issued certificate has expired or been replaced. eMudhra will complete its remaining commitments to the browser root programs, including a full root-cause report."
Google acknowledged that eMudhra has pledged to assist affected customers in migrating away from the compromised root but indicated it is "closely investigating the ongoing inclusion of eMudhra's remaining CA certificates in the Chrome Root Store."
Brian Fox, co-founder of cybersecurity company Sonatype, told Recorded Future News that the scope of the problem extends well beyond web browsers, as certificate trust stores are integrated into numerous software products. Each product may demand its own separate update, recompilation or new release, and most organizations lack visibility into where these trust stores are deployed, he explained.
"That makes this a software supply chain problem, not just a certificate revocation event. The fixes started shipping within days, but finding and adopting them is now the challenge," Fox said. "The long tail will be older releases, forgotten containers, embedded devices, and vendor tools that carry their own certificate bundles. Although now revoked, the original eMudhra-issued intermediates were not due to expire until April 2040, and outdated clients that do not process revocation information may continue trusting the affected chains until they are updated."
