Browsers Block Indian Certificate Authority eMudhra After Private Keys Compromised

Major browser makers have blocked certificates issued under eight intermediate certificate authorities operated by eMudhra, the Indian certification authority, after the private keys behind them were found to be compromised. Mozilla and Google Chrome pushed emergency blocks on Friday, hours after the problem was reported; Apple followed on Sunday, and Microsoft's protections rolled out on Monday. It is one of the most serious incidents to hit a publicly trusted certificate authority in years, and the first of this scale to involve an Indian CA.

The flaw was not a break-in but a mathematical weakness. According to disclosures accompanying the browser actions, the affected keys were generated with insufficient randomness, meaning anyone could compute the private keys from the publicly visible certificates. A security researcher demonstrated exactly that, reporting the compromise to browser root programs on Friday and proving possession by signing a message with each affected key. eMudhra has said a flaw in the April 2025 ceremony that created the certificates produced a second, weak set of keys alongside the intended ones, and that the weak set is what ended up published to browser root stores. The company says it is not aware of any exploitation before the disclosure.

Why this matters

Certificate authorities sit at the root of trust for the encrypted web. A browser's padlock means a CA has vouched that the site is who it claims to be. If a CA's private keys are known, an attacker can mint certificates for any website, a bank, an email provider, a government portal, and intercept traffic without triggering warnings. That is why the response was measured in hours: Mozilla completed its blocklist rollout the same evening the report arrived.

For browser users, the immediate danger has largely passed. The residual risk sits in software that does not use browser trust stores, server-to-server connections, mobile apps, embedded devices and enterprise systems that ship their own certificate bundles. Until those are updated, they may still trust certificates chained to the compromised keys. Security teams, including in India's large IT services and banking sectors, are being advised to audit their trust stores and distrust the affected intermediates explicitly.

What happens next

The incident now moves into the slower machinery of the web's trust ecosystem. Root programs run by Mozilla, Google, Apple and Microsoft will scrutinise eMudhra's incident response, its key-generation practices and the audit trail of the 2025 ceremony that produced the weak keys. Past CA incidents of comparable severity have ended in outcomes ranging from remediation plans to full distrust of the authority.

• Enterprises should inventory non-browser trust stores, application runtimes, operating system bundles, appliances, and apply vendor updates as they land.

• eMudhra's standing in browser root programs will depend on the transparency and speed of its post-incident reporting over the coming weeks.

• For India's digital ecosystem, which leans on domestic CAs for everything from digital signatures to e-governance, the episode will sharpen scrutiny of key ceremony practices across the sector.

The web's trust model survived this incident because one researcher checked the maths before an attacker did. The uncomfortable question for the industry is how weak keys sat in public root stores for a year and a half before anyone noticed.