Major technology companies have taken emergency security measures after researchers discovered a serious cryptographic weakness affecting eight intermediate digital certificates issued by Indian technology company eMudhra. Apple, Google and Mozilla have acted to block the affected certificates, while other technology providers have introduced additional safeguards to reduce the risk to internet users.
The issue became public in October 2026 after a security researcher reported that the private keys associated with the certificates could be recovered because they had been generated with insufficient randomness. Private keys are intended to remain secret and are essential to the security of digital certificates used to establish trust online.
The weakness could allow someone who recovered an affected private key to create fraudulent certificates and impersonate legitimate websites on systems that continued to trust the compromised certificate authority. Such misuse could expose users to phishing, credential theft and other security risks under certain circumstances.
The incident has prompted a coordinated response from browser developers and internet infrastructure providers. However, the available evidence does not establish that the weak keys were used in a successful attack against the general public.
What Happened to eMudhra's Digital Certificates?
eMudhra is an Indian digital trust company that provides services involving digital certificates and electronic authentication. Its certificates are part of the systems that help browsers and other software determine whether a website can be trusted.
According to the company's statement, the incident concerns eight intermediate certificate authorities created during a key generation ceremony on April 30, 2025. A flaw in that process produced a second set of weak keys alongside the intended strong keys. The weaker keys were subsequently used in the affected certificates.
Cryptographic keys must be generated using sufficiently unpredictable values. If the values are too easy to guess, an attacker may be able to recover a private key without breaking the underlying cryptographic algorithm.
In this case, security researchers reported that the affected keys were so weak that they could be recovered by testing a very small range of possible values. This undermined the trust that the certificates were supposed to provide.
eMudhra has said that it is investigating the root cause and reviewing its security controls. The company has also stated that the incident is limited to the specific intermediate certificates involved and does not affect its root certificate authority private keys or other intermediate certificates.
Why Are Digital Certificates Important?
Digital certificates play an important role in securing online communications. When users visit a website beginning with HTTPS, their browsers check its digital certificate as part of the process of establishing a secure connection.
The certificate helps verify the identity of the website and supports encryption between the browser and the server. Certificate authorities issue and sign certificates that browsers and operating systems recognise through established trust systems.
An intermediate certificate authority operates between a trusted root certificate and certificates issued to individual websites. If an intermediate certificate authority's private key is compromised, an attacker may be able to issue fraudulent certificates that appear to belong to legitimate websites.
This creates a potential risk because users generally rely on browser security indicators rather than manually verifying cryptographic information. A fraudulent certificate could make a malicious website appear more trustworthy on systems that have not yet rejected the affected certificate.
The eMudhra incident highlights how a failure in key generation can undermine an important part of internet security, even when the cryptographic algorithms themselves remain secure.
How Did Apple, Google and Mozilla Respond?
Google's Chrome Root Program confirmed that it received a report about the affected private keys on October 17, 2026. Google said it verified the findings and introduced an update to block the affected public-key identifiers in Chrome. The protection was designed to reach users without requiring them to install a new browser version or restart Chrome.
Google also announced further measures involving its trusted certificate store. The company said it was reviewing the continued inclusion of eMudhra's remaining certificates in its trust system. It indicated that removal of the affected root certificate from the Chrome Root Store was scheduled for a later release, with website operators expected to migrate away from certificates relying on that root.
Mozilla separately blocked the affected certificates in Firefox through its centralised certificate-revocation mechanism. It also released Firefox security updates and planned further changes to its certificate trust store.
Apple has also taken action against the affected certificates. Other technology providers and software maintainers have been working on measures to reduce the possibility that vulnerable systems will continue trusting them.
These actions are intended to limit the risk of fraudulent certificates being accepted. However, protections can differ between browsers, operating systems, applications and devices.
Has the Weakness Been Used in an Attack?
The discovery of weak private keys does not, by itself, prove that attackers used them to steal information or impersonate websites.
Google reported that its Certificate Transparency checks had not found certificates issued through the affected intermediate authorities before its blocking action. eMudhra has also stated that its internal analysis found that none of the affected intermediate authorities had issued end-entity certificates, although its investigation remains ongoing.
Certificate Transparency logs provide a public record of many publicly trusted TLS certificates. These records help researchers and technology companies identify suspicious certificate issuance. However, the absence of a known fraudulent certificate in these logs should not be interpreted as proof that every possible form of misuse has been ruled out.
The distinction is important for readers. The incident represents a serious security weakness, but the publicly available information does not establish a widespread attack on users or a confirmed leak of customer information.
What Does This Mean for Internet Users?
For most users, the immediate precaution is to ensure that browsers, operating systems and security applications are updated. Software updates can deliver changes to certificate trust lists and other protections that prevent affected certificates from being accepted.
Users should also remain cautious when visiting websites that request passwords, banking information or other sensitive details. Unexpected login links, suspicious messages and unfamiliar websites should be treated carefully, even when a browser displays a secure connection indicator.
A padlock or HTTPS connection alone does not guarantee that a website is legitimate. Users should check the website address carefully and access banking, government and other sensitive services through their official websites or trusted applications.
Organisations that operate websites, servers, applications or connected devices may need to take additional steps. Depending on the software they use, they may need to update certificate trust stores, replace affected certificates or install vendor-provided security patches.
Older devices and applications that do not receive regular updates may take longer to secure. This is one reason why the incident could require continued coordination across the technology industry.
What Has eMudhra Said?
In its public statements, eMudhra said the problem arose during a key generation ceremony in April 2025 and that the company was working to establish the precise cause. It stated that the affected certificates were limited to a specific group within its global TLS business.
The company has also said that its India digital signature certificate and eSign businesses are unaffected. This distinction matters because website TLS certificates and digital signature services can rely on different certificate hierarchies and operational systems.
The company has begun reviewing its security procedures and working with browser and certificate trust providers. The findings of that investigation will be important in determining how the weak keys were generated, how they were selected for the affected certificates and what additional controls may be necessary.
Why the Incident Matters for Cybersecurity
The eMudhra case demonstrates that the security of the internet depends not only on strong cryptographic algorithms but also on how keys are generated, stored and managed.
Certificate authorities occupy an important position in the internet's trust system. A weakness affecting certificates from a trusted authority can create risks for websites and users that have no direct relationship with that company.
The coordinated response from browser developers has reduced immediate risks for users of updated systems. Nevertheless, applications and devices that rely on separate certificate stores may require further attention.
For now, users should install available security updates and avoid assuming that every affected system has already received the necessary protections. Organisations should follow advisories from their software providers and review whether their infrastructure relies on any affected certificates.
The incident remains a reminder that reliable key generation, continuous monitoring and prompt security updates are essential to maintaining trust in online communications.
