Major Browsers Pull eMudhra Certificates After Critical Key Weakness Exposed

Mozilla, Google and Apple have removed a set of eMudhra intermediate certificates from their trusted stores after security researchers discovered that the certificates' private keys were trivially recoverable, enabling anyone to create forged certificates for authentic web sites.

The Indian certificate authority eMudhra responded by revoking eight intermediate certificates whose keys were deemed compromised. The revocation came after independent researchers demonstrated that the keys could be derived almost instantly using publicly available tools, effectively breaking the cryptographic protection that underpins the HTTPS trust model.

In the public‑key infrastructure that secures web traffic, certificate authorities (CAs) issue digital certificates linking domain names to cryptographic keys. Browsers trust these certificates because they are signed by CAs whose private keys are assumed to be securely guarded. When a CA’s private key is exposed, attackers can issue counterfeit certificates that browsers will accept as legitimate, opening the door to man‑in‑the‑middle attacks, credential theft and site impersonation.

The vulnerability uncovered in eMudhra’s intermediates is notable for the speed with which the private keys can be reconstructed. Researchers reported that the key generation parameters were weak enough that modern hardware could recover the keys in seconds, a scenario far more severe than typical key‑leakage incidents that require extensive computational effort.

Following the discovery, the three browser vendors promptly updated their root programs to distrust the affected intermediates, preventing browsers from recognizing certificates signed with the compromised keys. This action mirrors previous responses to high‑profile CA breaches, such as the 2011 DigiNotar incident and the 2020 WoSign controversy, underscoring the industry’s reliance on rapid revocation to protect users.

eMudhra’s decision to revoke the certificates is intended to mitigate any ongoing risk, but the episode raises broader questions about CA security practices, especially in regions where regulatory oversight may differ from that in the United States and Europe. Industry observers note that stronger key‑generation policies and regular third‑party audits could reduce the likelihood of similar weaknesses emerging.

Stakeholders are now watching how the revocation will affect websites that previously relied on the affected intermediates. Site operators will need to obtain new certificates from trusted authorities and update their configurations to restore full browser compatibility. The incident serves as a reminder that the security of the global web hinges on the rigorous protection of the cryptographic keys that anchor the trust chain.