Eight weak intermediate certificate keys exposed a fault in the web’s trust chain, prompting browser blocks and warnings that unpatched devices could remain vulnerable to website impersonation.
The security weakness uncovered in eMudhra’s certificate infrastructure has drawn attention to one of the internet’s most basic trust mechanisms: the digital certificate that lets a browser decide whether a website is genuine. According to Business Standard’s lead report, the issue centres on eight intermediate certificates whose private keys were weak enough to be recovered, creating the possibility that attackers could forge certificates and impersonate legitimate sites.
At the centre of the concern is the certificate authority model itself. eMudhra acts as a trusted issuer of digital certificates, helping websites prove their identity and enabling encrypted connections through HTTPS and Transport Layer Security. In practical terms, that means a browser can check whether a site’s certificate was signed by an authority it recognises and whether the connection should be treated as secure. But as the reporting makes clear, that protection only works if the underlying keys are sound.
CERT-In, India’s cyber emergency agency, has warned that compromised private keys could be abused to create fraudulent certificates, with the potential to intercept or alter traffic. Reuters, via PTI reporting cited in the lead article, said the advisory also highlighted the risk of impersonating websites. That is not the same as automatically breaking into bank accounts or stealing passwords, but it does create a route for man-in-the-middle attacks if an attacker can also divert traffic and present a forged certificate that a system still trusts.
eMudhra said in a statement on 21 October that the flaw arose during key generation rather than through a breach of its infrastructure. The company said the affected intermediate certificate authorities were created on 30 April 2025 using specialised hardware, but a process fault produced a second set of weak keys alongside the intended ones. It maintained that no Indian data had been breached and that its physical and digital security controls were intact, while also saying its investigation was continuing.
The company has also tried to limit the apparent scope of the incident. According to its statement, the affected certificates were tied to its global TLS business and accounted for about 1 per cent of revenue, while its Indian digital signature and eSign services were not impacted. Those domestic services, which support document signing and electronic verification, run on separate infrastructure, eMudhra said.
Browser vendors moved quickly once the weakness was reported. Google said it updated Chrome to block trust in certificates linked to the affected authorities, while Mozilla added them to a blocklist for Firefox and pushed security changes to how the browser handles trusted certificates. Cloudflare said it began rolling out protections across its network on 19 October and found no sign that the weakness was being actively exploited in its services. According to Google, no TLS certificates issued through six of the affected intermediate authorities had appeared in Certificate Transparency logs before the blocking action.
The issue is not limited to browsers, which can receive trust updates relatively quickly. Businesses, devices and network tools often rely on their own certificate stores, meaning some systems may remain exposed until they are patched or reconfigured. CERT-In has advised organisations to update browsers, operating systems and applications, review trusted certificate lists and replace affected certificates where needed. The advisory also called for checks on certificates linked to the emSign ECC Root CA – G3, which Google has said it plans to remove from trust in Chrome, a move that could affect some legitimate services.
Security specialists have argued that the case points to a broader weakness in the web’s trust architecture. Yash Kadakia, founder and chief technology officer of Security Brigade, told Business Standard that the problem goes beyond eight compromised keys and could have consequences for organisations that never directly dealt with eMudhra. He also questioned how the flaw escaped detection through mandatory security audits, underscoring a wider concern for regulators and certificate authorities: when the trust chain fails at one point, the impact can spread far beyond the original system.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
