eMudhra certificate security flaw triggers browser and developer response
Eight intermediate CA certificates issued by India-based eMudhra contained weak private keys, prompting emergency revocations by major browser vendors and software maintainers.
The Indian certificate authority eMudhra reported a critical flaw in the generation of private keys for eight of its intermediate CA certificates. The P-384 keys were generated with insufficient entropy, making them trivial to reconstruct. This vulnerability could have theoretically allowed an attacker to issue forged HTTPS certificates and perform man-in-the-middle attacks on web traffic.
Browser vendors, including Google, Mozilla, and Apple, responded by revoking trust in the affected certificates. Mozilla implemented a block via its OneCRL list within three hours of notification, while Chrome utilized its CRLSet mechanism to push updates to its users. Beyond browsers, the impact has extended to software development tools; projects such as Go, Python’s certifi, and Rust’s webpki-roots have issued updates to remove the compromised keys from their trust stores.
eMudhra stated that the issue stemmed from a key generation ceremony in April 2025. According to the company, most of the affected certificates were never deployed to production environments, and no end-entity certificates were issued using the compromised keys. A formal investigation into the process failure is ongoing.
Security researchers advise that while browsers have been secured, individual applications that rely on custom or bundled certificate stores may remain vulnerable. Users and developers are urged to update all software dependencies that manage TLS connections to ensure they are using the latest, verified trust anchors.