Major Browsers Pull Trust for eMudhra Intermediate Certificates After Key Compromise

Leading web browsers and operating‑system trust stores have removed several intermediate certificates issued by the Indian certificate authority eMudhra after security researchers uncovered that the private keys for eight of its certificates could be reconstructed. The move effectively blocks any TLS connections that rely on those intermediates, preventing them from being used to establish trusted HTTPS sessions.

Intermediate certificate authorities sit between a root CA and the end‑entity certificates used by websites. Their private keys sign the certificates presented to browsers; if those keys are exposed or can be recovered, an attacker could forge valid certificates that appear trustworthy. In eMudhra's case, the vulnerability lies in a recoverable private key, meaning the cryptographic material can be derived from publicly available information, a scenario that undermines the core trust model of public‑key infrastructure.

In response, the root programs that manage the trusted CA lists for Chrome, Firefox, Safari, Edge and major operating systems have added the compromised intermediates to their blocklists. The certificates are now flagged as untrusted, and browsers will display security warnings or refuse to load sites that present them. The coordinated action mirrors previous industry responses to similar CA incidents, reflecting the shared responsibility of vendors to protect users from forged identities.

eMudhra, a long‑standing provider of digital certificates in India, has been a participant in the global CA ecosystem for years. While the company has not publicly detailed the cause of the key recovery issue, the incident underscores the challenges that certificate authorities face in maintaining secure key management practices, especially when large numbers of certificates are issued under a common hierarchy.

Organizations that rely on the affected intermediate certificates are now urged to replace any end‑entity certificates that chain to them. This may involve re‑issuing SSL/TLS certificates, updating server configurations, and informing clients of the change. The sudden loss of trust can disrupt online services, particularly for enterprises that have not diversified their CA portfolio.

SecurityWeek first reported the blockage, noting that the investigation is ongoing and that eMudhra is working with browser vendors to remediate the situation. Industry observers expect additional guidance from the CA/Browser Forum and possibly a review of key‑generation procedures to prevent similar recoverable‑key scenarios in the future. Until the compromised intermediates are fully retired and replaced, users and administrators are advised to monitor browser updates and follow best practices for certificate management.