Browser Makers Remove Trust for eMudhra Certificates After Critical Key Flaw Discovered

Mozilla, Google, and Apple said they will drop trust in a group of eMudhra intermediate certificates after security researchers showed that the certificates' private keys can be extracted within seconds, enabling attackers to create bogus SSL/TLS certificates for any site.

Independent cryptography analysts uncovered that eight intermediate certificates from the Indian CA eMudhra used cryptographic material so feeble that their private keys could be rebuilt almost instantly. Possession of those keys would let a malicious actor sign certificates that browsers would treat as authentic, opening the door to phishing, man‑in‑the‑middle attacks and other credential‑stealing schemes.

eMudhra reacted by revoking the affected intermediates and releasing a public statement that admitted the defect. The revocations quickly appeared in the Certificate Transparency logs, and the three browsers revised their trust stores to reject the certificates. This swift collaboration narrowed the exposure period, yet the episode highlights the persistent danger of weak key‑generation methods in the PKI.

Certificate authorities act as the foundation of trust for HTTPS traffic, with browsers depending on a vetted roster of trusted CAs to confirm site identities. If a CA’s private key is compromised, every certificate in its chain becomes exploitable. The eMudhra incident serves as a reminder that intermediate authorities, not only root CAs, must follow strict key‑generation protocols and be subject to periodic audits.

Experts suggest the breach could trigger a wider reassessment of key‑strength mandates throughout the ecosystem. The CA/Browser Forum, responsible for baseline security rules for certificate issuance, may tighten specifications regarding key lengths and entropy sources. At the same time, entities relying on eMudhra certificates are advised to confirm that their certificates have been re‑issued by unaffected authorities.

For typical users, the real‑world effect is limited: browsers will show usual warnings when they meet a site using a revoked eMudhra certificate. Still, the episode underscores the need to keep browsers current, since security patches and trust‑store updates remain the chief safeguard against supply‑chain attacks of this sort.