Browser Vendors Pull Trust for eMudhra Certificates After Critical Key Weakness Exposed

Mozilla, Google and Apple announced that they are removing trust for a set of eMudhra intermediate certificates after security researchers demonstrated that the certificates' private keys could be derived in seconds, allowing attackers to issue fraudulent SSL/TLS certificates for any domain.

The discovery, made by independent cryptography analysts, revealed that eight intermediate certificates issued by the Indian certificate authority eMudhra contained cryptographic material so weak that the private keys could be reconstructed virtually instantly. With those keys, an adversary could sign certificates that appear legitimate to browsers, potentially enabling phishing, man‑in‑the‑middle attacks and other forms of credential theft.

In response, eMudhra revoked the compromised intermediates and issued a public statement acknowledging the flaw. The revocation was promptly reflected in the Certificate Transparency logs, and the three major browser vendors updated their trust stores to block the certificates. This rapid coordination limited the window of exposure, but the incident underscores the ongoing risk posed by weak key generation practices in the public‑key infrastructure.

Certificate authorities serve as the root of trust for HTTPS connections, and browsers rely on a curated list of trusted CAs to validate website identities. When a CA’s private key is compromised, the entire chain of certificates it issued can be abused. The eMudhra case is a reminder that even intermediate authorities, not just root CAs, must adhere to stringent key‑generation standards and undergo regular audits.

Industry observers note that the incident may prompt a broader review of key‑strength requirements across the ecosystem. The CA/Browser Forum, which sets baseline security policies for certificate issuance, could tighten guidelines on key sizes and randomness sources. Meanwhile, organizations that depend on eMudhra certificates are being urged to verify that any certificates they use have been re‑issued from unaffected authorities.

For end users, the practical impact is minimal: browsers will display standard warnings if they encounter a site presenting a revoked eMudhra certificate. Nonetheless, the episode highlights the importance of keeping browsers up to date, as security patches and trust‑store updates are the primary defense against such supply‑chain compromises.