Overview
- Security researchers reported on October 17 that eight intermediate CA private keys generated by eMudhra were trivially small and easily recoverable, prompting vendors to act.
- eMudhra revoked the affected intermediates within 14 hours of confirmation and on October 22 said it would commission an independent review and withdraw from the global SSL/TLS certificate market.
- Apple, Google, Mozilla and Microsoft implemented blocks in browsers and platform frameworks and Microsoft pushed Windows updates to remove several eMudhra roots for machines that do not get automatic certificate updates.
- Practical gaps remain because some macOS command‑line tools, Java runtimes and embedded or legacy systems use separate trust stores and will accept the chain until vendors issue specific fixes or administrators apply workarounds.
- The incident has triggered national investigations, vendor rollouts and renewed scrutiny of CA oversight because public records show the weak keys and related artifacts were visible in industry databases and passed prior audits without detection.