Major Browsers Drop Trust in eMudhra Certificates Following Exposure of Critical Key Flaw

Mozilla, Google and Apple said they will no longer trust a group of eMudhra intermediate certificates after researchers showed that the private keys could be extracted within seconds, enabling attackers to create bogus SSL/TLS certificates for any site.

The finding, reported by independent cryptography analysts, identified eight intermediate certificates from the Indian CA eMudhra that used cryptographic material so weak the private keys could be reconstructed almost instantly. Possession of those keys would let a malicious actor sign certificates that browsers would accept as legitimate, opening the door to phishing, man‑in‑the‑middle attacks and other credential‑theft schemes.

eMudhra responded by revoking the affected intermediates and releasing a public statement that admitted the vulnerability. The revocations appeared quickly in the Certificate Transparency logs, and the three leading browsers updated their trust stores to block the certificates. This swift collaboration curtailed the exposure window, yet the episode highlights the persistent danger of weak key‑generation in the public‑key infrastructure.

Certificate authorities form the foundation of trust for HTTPS traffic, with browsers depending on a vetted list of trusted CAs to confirm site identities. If a CA’s private key is compromised, every certificate in its chain can be misused. The eMudhra incident serves as a reminder that even intermediate CAs, not just root authorities, must follow strict key‑generation practices and undergo regular audits.

Analysts suggest the breach could trigger a wider reassessment of key‑strength standards throughout the ecosystem. The CA/Browser Forum, which defines baseline security rules for certificate issuance, may tighten requirements on key sizes and randomness sources. In the meantime, organizations using eMudhra certificates are advised to confirm that any certificates they rely on have been re‑issued by unaffected authorities.

For typical users, the direct effect is limited: browsers will show the usual warnings if they encounter a site presenting a revoked eMudhra certificate. Still, the incident underscores the need to keep browsers current, as updates to the software and trust stores remain the primary shield against such supply‑chain attacks.