In a concerning development for digital security, it has been reported that the private keys associated with eight intermediate certificate authorities operated by the Indian digital trust provider eMudhra have been compromised. This breach potentially allows malicious actors to forge trusted certificates, posing a significant risk of impersonating websites or services. Authorities such as Google and Mozilla have raised alarms over the incident, highlighting the gravity of the situation.
On October 17, Mozilla received a critical report forwarded by the Chrome Root program at approximately 20:06 UTC. The report indicated that the private keys of eight eMudhra intermediate certificates had been compromised. Dennis Jackson, a member of Mozilla’s engineering team, detailed the findings in a public Mozilla bug report, stating, “An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.” This revelation underscores the seriousness of the incident, given the vital role that certificate authorities play in establishing trust on the internet.
Later on the same day, Mozilla independently discovered the compromised keys at 21:48 UTC, confirming their vulnerability. Jackson elaborated that the recovery process revealed a significant flaw in the key generation procedure, which was evidently trivial to exploit. This further raised concerns about the robustness of the cryptographic processes in place at eMudhra.
The issue was originally flagged by a researcher known as Wayne, whose findings were subsequently communicated to Mozilla through the Chrome Root Program. In response, Mozilla began blocking the affected certificates in its Firefox browser to immediately safeguard users against potential threats.
eMudhra acknowledged the report and indicated that an investigation into the incident was underway. Meanwhile, security expert Scott Helme highlighted the gravity of the situation, noting that the keys included were particularly weak. He famously referenced one of eMudhra’s certificate authority private keys as being simply the number “4”, while others were valued at “56” and “115”. In a demonstration of the vulnerability, Helme was able to recover all eight compromised keys from their public certificates in under a second.
Of the eight affected intermediate certificates, six were designed for Transport Layer Security (TLS) applications, which are foundational for authenticating websites and establishing encrypted connections. The remaining two were designated for code signing. Google further elaborated, noting that the private keys for these certificates were generated with insufficient randomness, indicating a weak cryptographic entropy. This deficiency enables anyone with the compromised keys to forge trusted HTTPS certificates, allowing for impersonation of any website for clients that have not yet revoked trust in those certificate authorities.
In response to the security breach, Google’s Chrome Root Program quickly implemented a blocking update across the Chrome browser. This immediate action protected users from all certificates utilizing the compromised keys, negating the need for a browser update or restart. The measure also extended to Android devices and Chromebooks, with equivalent updates rolling out through Google Play Services.
Google noted that no TLS certificates linked to the six affected intermediates appeared in Certificate Transparency logs prior to the blocking action. Consequently, no fraudulent certificates issued by those authorities could have been exploited against clients enforcing Certificate Transparency. Meanwhile, Mozilla completed the distribution of its OneCRL block to Firefox users with standard configurations and also updated those who had custom settings that may have previously blocked these protections.
In a related development, Google announced the removal of the emSign ECC Root CA – G3 certificate, which had signed the compromised intermediates, from the Chrome Root Store. This change is scheduled to reach all devices reliant on that root store by October 27, ensuring further security for users.
Yash Kadakia, the founder and CTO of Security Brigade, emphasized the broader implications of the compromised keys. He projected that approximately 30,000 legitimate certificates would need migration to avoid browser warnings or access disruptions, particularly affecting government and public-sector websites. Kadakia articulated the importance of maintaining a robust global chain of trust, stating, “A single authority’s failure can undermine authentication for organizations that have never dealt with it.”
Additionally, Kadakia advised enterprise security teams to perform thorough checks on their systems. They should scrutinize payment gateways, vendor integrations, older Java applications, mobile applications, and network appliances, as these may utilize certification trust stores separate from browsers. He also recommended organizations to assess whether affected clients reject certificates signed by the compromised keys.
Cloudflare, another key player in the digital infrastructure, confirmed that it became aware of the compromise on October 19 and took immediate action to deploy mitigations across its services, including content delivery networks and security products. Their preliminary security review indicated that there had been no active exploitation of the issue on their services.
In an official statement, eMudhra clarified that the compromised intermediate authorities were established during a security key-generation ceremony in April 2025. They stated that the breach did not affect their root CA private keys or other intermediate authorities, noting, “None of these intermediate CAs, including the one deployed in production, have issued any end-entity certificates.” While this news offers some reassurance, experts like Kadakia noted that anyone with access to a compromised key could still generate fraudulent certificates independently.
As of now, eMudhra has not provided further comment on the ongoing investigation into this incident, though the implications of this breach are significant and warrant ongoing scrutiny from digital security experts and authorities alike.