India Orders Probe Into eMudhra Certificate Flaw as Browsers Block Weak Keys

India's Ministry of Electronics and Information Technology has set up a special team to investigate a security incident at eMudhra, the Bengaluru based certificate provider, after eight of its intermediate certificate keys were found to be dangerously weak. The ministry announced the probe in a series of posts on X on Wednesday, October 21, and said it had taken serious note of the incident.

The weak keys sit inside the system the web uses to prove a site is what it claims to be. A certificate authority checks identities and issues digital certificates. Browsers trust those certificates to set up secure HTTPS connections. If an attacker holds a weak private key, the attacker can create fraudulent certificates and impersonate legitimate websites, security researchers warned.

How the flaw happened

eMudhra said a step in its key generation procedure produced a second, weak set of keys alongside the strong ones. The keys were generated on April 30, 2025, and the weak set was published to browser root stores, where it stayed undetected for about 18 months. The company said its root private key was not compromised, its infrastructure was not breached, and no customer data was taken.

The flaw came to light on October 17, when a researcher alerted Apple, Google, Microsoft and Mozilla that the private keys linked to the eight certificates could be reverse engineered, possibly with AI assisted techniques. CERT-In, India's computer emergency response team, said the eight affected certificates include six TLS certificates and two code signing certificates. TLS certificates secure connections between websites, browsers and apps. Code signing certificates vouch for software.

Browsers act, ministry draws a line

Google blocked the affected keys and said Chrome will remove the associated root, the emSign ECC Root CA - G3, from its trust store starting October 27. Mozilla blocked the certificates in Firefox within three hours of getting the report. Browser operators have withdrawn trust from the root as a precaution, and CERT-In has issued an advisory with steps to limit the damage. The advisory warns that removing the root may leave some legitimate certificates untrusted, which could disrupt affected websites and services.

The ministry was clear about what the incident does not touch. It said the case concerns only eMudhra's international website security business, which runs under a global trust framework and separate audits. Digital Signature Certificates and eSign services regulated in India run on separate systems and remain completely unaffected, the ministry said. It put the impact on Indian websites and apps as very limited and brief, and it warned against fear mongering on social media.

eMudhra said none of the eight affected intermediate authorities issued end user certificates. It named one affected customer ecosystem in the United States, where certificates are being replaced. The global TLS business at the center of the case accounts for about 1 percent of company revenue, it said. The company is reviewing its key generation procedures and offering enterprise customers certificates from an additional authority. It also said it has not yet confirmed the exact root cause and will publish it in full once its own investigation is complete. More detail is expected once the ministry's team reports.