Overview
- An independent researcher disclosed over the weekend that eight intermediate certificate keys generated by eMudhra in April 2025 were far shorter than required and could be reconstructed to produce private keys.
- Within hours of the disclosure, Google, Mozilla, Apple and Microsoft stopped trusting the affected intermediates and eMudhra revoked the eight certificates it said were impacted.
- eMudhra announced on Thursday that it will withdraw from the global website SSL/TLS certificate business, saying the affected keys were not used commercially and that no data breach occurred.
- India’s MeitY has formed a special team to investigate and CERT-In issued advisories while eMudhra’s shares fell about 40% as markets reacted to the fallout.
- Security experts warn that browser blocks do not protect all systems because legacy devices, payment terminals and custom trust stores may still accept the compromised chains, and the incident raises questions about key‑generation testing and audit effectiveness.