eMudhra's CA Keys Vulnerability Exposed for 17 Months
A significant security flaw in eMudhra's certificate authority keys has raised alarms after being publicly disclosed, revealing weak private keys.
eMudhra's CA keys were compromised due to weak private key generation.
Major tech companies quickly revoked trust in the affected certificates.
The incident highlights risks for applications and devices that may still trust the compromised certificates.
A critical security vulnerability involving eMudhra, an Indian certificate authority, has come to light, revealing that eight of its intermediate certificates were secured with exceptionally weak private keys. These keys could be recovered in less than a second from public certificates, raising serious concerns about potential misuse. The flaw was identified by security researcher Wayne on October 17, who demonstrated the issue by signing a message with the compromised keys and subsequently alerted major tech companies including Apple, Google, and Microsoft.
The incident traces back to a batch of 24 intermediate certificates generated by eMudhra on April 30, 2025. Among these, six were designated for issuing TLS certificates for websites, while two were meant for code signing. All eight certificates were cross-signed by Sectigo in May 2025. The compromised keys were alarmingly short, with some being as simple as the number '4', making them easily guessable. Scott Helme, another security researcher, confirmed that he was able to recover these keys in mere seconds, underscoring the severity of the oversight.
Following the public disclosure of the vulnerability, browsers acted swiftly. Chrome and Firefox blocked the compromised certificates on the same day the issue was reported, while Apple and Microsoft followed suit shortly after. eMudhra took action to revoke the certificates on October 18, just a day after the initial report. However, the incident has raised concerns about devices and applications that may not receive timely revocation updates, potentially leaving them vulnerable to attacks.
The implications of this security breach extend beyond just browser trust. While major browsers have taken steps to protect users, applications and servers that rely on outdated certificate lists may still trust the compromised certificates, posing a risk to user data. The incident has prompted eMudhra to reassess its certificate issuance processes and implement stricter checks to prevent similar occurrences in the future.
Looking ahead, eMudhra has acknowledged the human errors that led to the creation of the weak keys and has committed to reviewing all past key ceremonies. The company estimates that around 30,000 customer certificates will need to be replaced as a result of this incident. As the tech community continues to evaluate the situation, users are advised to update their browsers and operating systems to mitigate potential risks associated with the compromised certificates.
