Indian tech company eMudhra announces withdrawal from certificate business after security incident

One of the only Indian root certificate authorities trusted by major web browsers said it is withdrawing from the global certificate business after facing significant backlash over a security incident this week. 

The company, eMudhra, said it was voluntarily withdrawing from the global SSL/TLS certificate business after the private keys of eight of its intermediate certificates were found to be weak, prompting browsers like Firefox, Apple and Chrome to block the certificates. 

According to Google, Mozilla and several other companies, the keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.

Cloudflare explained that the certificates were widely trusted by their own system as well as browsers and operating systems. Because of the weak keys, any attacker could create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. 

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the private keys was just the number four. Others were simply 56 and 115. 

eMudhra said this week that the certificates were created during a ceremony in April 2025 and the ”problem was a flaw in one step of the ceremony procedure.” The issue went undetected for 18 months and survived two independent audits before a researcher reverse engineered the weak keys, the company said. 

eMudhra’s chairman, V. Srinivasan, said on Thursday that the company revoked the affected certificates within 14 hours of their discovery and claimed there were no compromises or data breaches as a result of the issue. 

India’s Ministry of Electronics and IT said it is investigating the incident but defended the company, arguing that “some social media accounts are indulging in fear mongering about the impact of this incident.”

CERT-IN warned in its own alert that an attacker able to exploit the compromised private keys could "potentially impersonate legitimate websites or intercept or modify data exchanged between users and servers, potentially facilitating credential theft, sensitive data exposure and financial fraud." 

They added that the ability to issue fraudulent certificates would also enable malicious software to appear to be digitally signed by a trusted publisher.

Withdrawing

In the announcement of its withdrawal from the certificate business, Srinivasan said it only accounted for 1% of the company’s revenue but became increasingly costly due to compliance requirements and “complexity.”

Srinivasan blamed “social media amplification” for the increased scrutiny around the company. eMudhra said it will work with browser programs and customers to transition them to other options. 

“Revocation and certificate status services will keep running until every issued certificate has expired or been replaced. eMudhra will complete its remaining commitments to the browser root programs, including a full root-cause report,” the company said. 

Google noted that eMudhra has committed to working with impacted subscribers to migrate customers off of the impacted root but said it is “closely investigating the ongoing inclusion of eMudhra's remaining CA certificates in the Chrome Root Store.”

Brian Fox, co-founder of cybersecurity firm Sonatype, told Recorded Future News that the issue goes far beyond browsers because certificate trust stores are embedded in dozens of products. 

Each may require its own update, rebuild or release, and most organizations don’t have an inventory of where they live, he said. 

“That makes this a software supply chain problem, not just a certificate revocation event. The fixes started shipping within days, but finding and adopting them is now the challenge,” he said. 

“The long tail will be older releases, forgotten containers, embedded devices, and vendor tools that carry their own certificate bundles. Although now revoked, the original eMudhra-issued intermediates were not due to expire until April 2040, and outdated clients that do not process revocation information may continue trusting the affected chains until they are updated.”