Imagine a lock with only 256 possible keys. A thief could try every key in less than a second. Researchers found a similar security problem at eMudhra, an Indian company that helps browsers identify trusted websites. Eight digital certificates created in April 2025 had extremely weak private keys that hackers could crack almost instantly. Apple, Google, Microsoft and Mozilla have blocked these certificates, while Cloudflare has issued guidance and updates for its customers. So far, there is no confirmed evidence that anyone misused the weakness. Here is the full eMudhra story explained in seven simple points.
eMudhra is an Indian company that provides digital security solutions as well as cybersecurity services. In simple words, it issues digital certificates, identity verification and authentication services. It also works as a Certificate Authority (CA). This means it helps web browsers check whether a website is genuine before creating a secure connection.
Digital certificates work like identity cards for websites. They help browsers check whether a website is real or fake. If the certificates issued by a trusted Certificate Authority are compromised, many internet users could be at risk.
The issue involves eight intermediate Certificate Authority certificates created on April 30, 2025. According to researchers, their private keys were expected to use the P-384 elliptic curve cryptographic system, which provides an extremely large range of possible values.
However, the keys turned out to be single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237. With only 256 possible single-byte values, researchers could recover all eight private keys in less than a second. Six of the certificates were meant for websites (TLS) and two for code signing.
Also read: India smartphone shipments fall 26 pct in Q3 2026 as Samsung regains top spot: Report
The private key plays an essential role within a digital certificate for securing online communication. Once the private key falls into the wrong hands, the intruders can create fraudulent certificates to pose as genuine websites or online services.
In this case, the intruders could trick a web browser into treating the fraudulent site as a legitimate one, making users susceptible to data theft or interception of online communication. The presence of such weak keys is a serious vulnerability, but it does not mean that such attacks took place. Google said that no certificates linked to the affected website certificates had appeared in public Certificate Transparency logs, so a forged certificate would not have been trusted by default in Chrome. That does not rule out misuse against software outside browsers.
This led to action taken by browser and technology companies. Firefox and Chrome blocked the certificates from October 17, Apple devices from October 19, and Microsoft platforms from October 20. Mozilla has also begun removing trust in eMudhra’s emSign ECC Root CA – G3 entirely, and Chrome has committed to a similar path. Companies such as Cloudflare have released updates and guidance for their customers.
This joint action is meant to ensure that browsers do not use the compromised certificates at all. Nonetheless, some systems outside the major browsers need further updates before they stop trusting the certificates.
Also read: Deepinder Goyal announces Dark.ai: All you should know about Eternal’s upcoming AI bot
eMudhra acknowledged the issue and said it was investigating the eight intermediate certificates generated during a Key Generation Ceremony in April 2025. It told Mozilla that a code flaw during an approved test created a second, weaker set of keys, which were then used by mistake.
The company stated that the problem was limited to the affected certificates and did not compromise its root Certificate Authority private keys or other intermediate certificates. It also said only one of the eight certificates had been deployed in production and that none had been used to issue certificates for individual websites. These are eMudhra’s own statements. eMudhra has also stopped issuing from all intermediates under the affected root and estimates that about 30,000 certificates will need to be migrated.
Although major browser makers have acted, removing trust in affected certificates across the internet is not necessarily immediate. Cloudflare warned that some customers might need to update custom certificate trust stores and server configurations. Because the weak keys were also cross-signed by Sectigo, administrators may need to remove more than one root certificate from their trust stores.
Older systems, specialised applications and independently managed environments may require separate attention. This makes coordination between certificate providers, software companies and system administrators important to containing the risk.
If you want to stay safe, then you should keep your browsers, operating systems and apps updated and install security updates as soon as possible. Aside from that, the users should not change certificate settings on their own unless a trusted technical expert advises them to do so.