Tech Platforms Pull eMudhra Certificates After Key Compromise

Google, Mozilla, Apple, the Go programming language project and several other major internet stakeholders announced today that they have disabled a set of digital certificates issued by Indian certificate authority eMudhra, after learning that eight of the authority's private keys appear to have been compromised.

The revoked certificates were used to secure web sites and services with Transport Layer Security (TLS), a protocol that encrypts data between browsers and servers. When a certificate’s private key is exposed, attackers can impersonate the site, decrypt traffic, or launch man‑in‑the‑middle attacks, undermining the trust model that underpins secure online communication.

In response, Google updated its Chrome browser and Certificate Transparency logs to reject the affected certificates, while Mozilla added them to its blocklist for Firefox. Apple similarly updated its trust store for Safari and macOS, and the Go project removed the keys from its built‑in root store used by Go applications. Other vendors that rely on shared trust stores have taken comparable steps, effectively cutting off the compromised credentials across most major platforms.

The exact method by which the eight keys were breached has not been disclosed, and eMudhra has not provided details on the root cause. Analysts suggest possibilities ranging from insider leakage to external hacking, but no definitive evidence has emerged. eMudhra has pledged to cooperate with investigators and to conduct a thorough internal review.

Industry observers note that the incident raises broader concerns about the resilience of regional certificate authorities, especially as they become integral to the growing digital economy in India. A loss of confidence in a local CA could push businesses toward larger, global authorities, potentially increasing costs and affecting the ecosystem of domestic cybersecurity services.

Going forward, eMudhra plans to re‑issue new certificates using fresh key material and to strengthen its key management procedures. The affected vendors have indicated they will monitor the situation and may restore trust for newly issued certificates once they are confident the compromise has been fully contained. The episode underscores the importance of rigorous key protection practices and rapid response mechanisms in maintaining the integrity of the internet’s trust infrastructure.