Governance & Risk Management,
Security Operations
eMudhra Admits to Using Weak Certificates to Sign Eight Intermediary Certs
Bengaluru-based certificate authority eMudhra is under scrutiny following its revelation that it mistakenly issued eight intermediary certificates with extraordinarily weak encryption keys. The questionable encryption keys were reported to be only one byte in length, a revelation that raises significant concerns from cybersecurity experts, who warn that such vulnerabilities could facilitate severe exploitation by hackers.
According to the organization, a script that was deployed in April 2025 inadvertently generated the compromised certificates, which were subsequently used for certificate signing within the same month. eMudhra acknowledged that the similarities in key labels led to this critical oversight.
This incident has serious implications for application developers reliant on root certificate validation libraries. Unlike web browsers, which routinely check the validity of certificates against revocation lists, developers must actively update their systems to remove these now-revoked certificates, potentially hindering app functionality across various platforms.
Cybersecurity platform Cloudflare has sounded the alarm, warning that malicious actors could leverage the vulnerable certificates—known to have private key values that fell within the range of zero to 255—to impersonate servers and interfere with data traffic. Alarmingly, six of these intermediary certificates were intended for Transport Layer Security (TLS)—the cryptographic protocol widely employed across the internet—and had gained acceptance from the leading root stores including Chrome, Mozilla, Microsoft, and Apple. The two remaining certificates, which were designed for code signing, were similarly trusted by Microsoft.
EMudhra asserted that, despite the gravity of the situation, only one of the weak certificates actually made it to production. The company also clarified that none were issued for end-user entities, such as web servers or applications. Notably, the primary root stores have begun listing the weak certificates on their revocation lists to avert potential misuse.
However, caution remains as many clients do not currently utilize revocation information. They will need to execute software updates to ensure that they no longer trust the compromised intermediates. By Saturday, both Google Chrome and Mozilla Firefox had moved swiftly to block the flawed certificates, simultaneously blacklisting the root certificate used to sign these intermediaries. Google’s revocation action is anticipated to reach affected devices by October 27.
In a statement reflecting its concern over the seriousness of this breach, Google noted that the Chrome Root Program is conducting a thorough investigation to determine the fate of eMudhra’s remaining CA certificates in its root store.
eMudhra, which is recognized as one of the few Indian certificate authorities accepted by major root stores, has issued over 60 million digital certificates across 21 countries. In turn, Sectigo, a digital certificate provider, has responded by revoking the deficient certificates, further complicating the fallout from this incident.
As part of transitioning affected customers, eMudhra estimates that around 30,000 certificates will need to be migrated to a different trust chain. Acknowledging that distrust emanating from root stores regarding the compromised root certificate could impact certain customer ecosystems, the firm is actively collaborating with affected parties to work on measures for a smooth transition.
Yash Kadakia, the founder and CTO of Mumbai-based cybersecurity firm Security Brigade, echoed the need for heightened scrutiny by the Indian government regarding the efficacy of mandatory security audits. He noted that failures by a single authority could weaken authentication measures crucial for organizations unfamiliar with such vulnerabilities, predicting a potentially extensive cleanup process for devices and software that are difficult to update.
In the wake of these developments, various programming platforms have acted decisively. The Go programming language warned users about discontinuing trust in specific certificates tied to this security breach and recommended upgrading to new versions. Similarly, core developers of Python urged programmers to undertake immediate updates to eliminate reliance on the affected certificates, while Rust developers also announced necessary patches.
The seriousness of the situation was further highlighted by security researcher Scott Helme, who successfully cracked the vulnerable certificates to retrieve the private key values. This prompted renewed discussions within the cybersecurity community regarding the robustness of public-private key encryption as it applies to digital certificate authenticity.
Even as recovery efforts persist, the Indian Ministry of Electronics and Information Technology has opened an investigation into the matter. This situation reflects a significant challenge not only for eMudhra but also for the entire ecosystem surrounding digital certificate issuance and management.