Overview
- Independent researchers publicly reconstructed the eight weak intermediate CA private keys in mid‑October, and Google, Mozilla, Apple and Microsoft moved between October 17 and 20 to stop trusting the affected certificates while eMudhra revoked those CAs and announced its exit from the global SSL/TLS business.
- The keys were created during an April 30, 2025 key ceremony and were shortened by a software error so that private values were tiny numbers such as 4, 56, 66, 115, 155, 156, 230 and 237, making them trivial to rebuild from public certificates.
- eMudhra says it revoked the eight affected intermediate CAs within hours of disclosure, maintains there is no confirmed customer data breach and asserts the compromised CAs were not used to issue end‑entity certificates commercially.
- India’s MeitY and CERT‑In have opened investigations and issued advisories while eMudhra’s shares fell about 40% as investors and customers pressed for independent audits and clearer company disclosure.
- Security experts warn that non‑browser trust stores on older phones, IoT devices, payment terminals and bespoke enterprise systems may remain vulnerable until operators replace certificates or apply updates, creating a long tail of remediation and oversight questions for the web PKI ecosystem.