In another security incident, researchers have found that eight digital certificates issued by the Indian cybersecurity company eMudhra were protected by secret keys so weak that they could be cracked in less than a second. Google, Apple, Microsoft and Mozilla have now blocked the certificates. So far, there is no evidence that anyone used the flaw to carry out an attack. While some are asking how such a basic mistake got through in the first place and how long it will take to clean up across the internet, a majority is trying to understand why this matters, how they are impacted and what they should do to keep themselves safe. Here’s the security incident explained.
What is eMudhra and what does it do
Let’s start with an example. Every time you open a website, your browser has to check that it is talking to the real site and not an imposter. It does this using digital certificates, which work like ID cards for websites. There are companies that issue these ID cards. They are called Certificate Authorities, and eMudhra is one of them – an Indian digital trust and cybersecurity company. It sells certificates under the emSign brand through companies in India, the United States and the Netherlands. Major browsers keep a list of companies they trust, and eMudhra is on the lists of Mozilla (Firefox), Chrome (Google) and Safari (Apple).In a real world scenario, consider you want to buy an iPhone. You can either buy it from the Apple Store or retail partners that are authorised to sell those phones which means that you will get a product that meets the highest standard. In the certificate world, consider these retail partners as intermediate certificates. Each one has a secret key, which works like Apple’s official stamp. Anyone who holds the stamp can issue IDs that look genuine to everyone else.
What exactly happened
eMudhra created eight of these intermediate certificates last year. Six were meant for websites and two were meant for signing software. The secret key for each should have been an enormous random number, one with around 1 followed by 115 zeros possible values. Instead, the keys turned out to be tiny numbers. One was simply the number 4, and the others were 56, 66, 115, 155, 156, 230 and 237.To understand this, think of a padlock. A good one has so many possible combinations that nobody could ever try them all. These keys were like a padlock with only 256 possible combinations, which can be opened by trying every one in a blink. Researchers recovered all eight keys in less than a second.The keys were not stolen. Google’s security teams said they were created with too little randomness, so anyone can work them out from the public certificates. eMudhra says a flaw in the April 2025 process that created the certificates produced a second, weak set of keys alongside the intended strong ones, and the weak set is what got published to the browser lists.
Why it matters
If someone held these keys, they could issue a certificate for any website that a browser would accept. In everyday terms, you could land on what looks like your bank’s website or a shopping site and have no idea you are connected to a fake one. Your browser would see nothing wrong. An attacker could also read or tamper with the information, including sensitive details, passing between you and a website.A researcher reported the problem to the browser companies on October 17. To prove it, the researcher signed a message with each of the eight keys. Chrome and Firefox blocked the certificates within hours. Apple blocked them on October 19 and Microsoft on October 20. Android phones got a similar block through Google Play Services on October 19. eMudhra has revoked the eight certificates, and Cloudflare and other software providers have released fixes.According to the company, there is no evidence so far that the weak keys were used in a cyberattack, though it is not known for certain whether anyone misused them since they were created. Chrome said that, before it blocked them, no website certificates issued through the six website certificates had been recorded in the public logs it requires. That means Chrome and similar browsers would not have trusted such certificates by default.
What eMudhra has to say
In a statement, eMudhra said the problem was limited to these intermediate certificates and did not affect its main root keys or its other intermediate certificates. It added that only one of the eight had been put to use, and that none of the eight had issued a certificate to any individual website. The company also said its systems were not hacked and no data was breached. It said its Indian digital signature and eSign businesses run on separate systems and are not connected to the incident.
What this means for eMudhra
On October 20, Mozilla removed one of eMudhra’s main roots (emSign ECC Root CA – G3) from its trusted list. Chrome will remove the same root in its next update to its trusted list. That removal is expected to reach devices on the morning of Tuesday, October 27, Pacific time. Chrome is also reviewing eMudhra’s other main root, citing the seriousness of the incident. Website owners whose certificates depend on that root must switch to a certificate from another provider before then to avoid problems. Google says eMudhra has committed to moving those customers.
How are everyday users affected, and what should they do
For most people, nothing much is needed. Browsers get these blocks pushed to them automatically, and Chrome and Firefox did not need a manual update or a restart. The best thing that users can do is to keep their browsers, phone and apps up to date so they have the latest fixes. Don’t try to change certificate settings.Some software is a different story. Many programs, mostly tools used by developers and companies, do not receive these blocks automatically and keep trusting a certificate until the software itself is updated. Cloudflare has warned that customers who run their own servers or systems may need to update them by hand. Mozilla has also warned that some websites and servers may stop working for users of software that relies on its list until they move to new certificates.
