Overview
- An independent researcher flagged weak eMudhra certificates this week, leading Google, Mozilla, Apple and Microsoft to remove trust in the affected intermediates and prompting eMudhra to revoke all eight keys.
- eMudhra says the problem began in April 2025 when its software produced eight shortened private keys with insufficient randomness that make the keys far easier to recover.
- Indian authorities have opened formal probes: MeitY set up a special team and CERT-In issued advisories that called out the weak key generation and urged firms to install related PHP security patches.
- Replacing and patching affected certificates is already underway but is complex because many systems use embedded or custom trust stores found in legacy devices, internal apps and IoT, which may not update quickly.
- The disclosure hit markets and corporate plans: eMudhra’s shares fell about 40%, the company said the SSL/TLS unit was about 1% of revenue, and experts warn the incident exposes wider gaps in enterprise cyber-hygiene and the difficulty of restoring trusted certificate roots.