After a blunder by an Indian provider of security certificates left part of the internet unsafe, the company is withdrawing from the market. That does not undo the damage.
Last week it emerged that an Indian provider of security certificates had made an enormous blunder. eMudhra issues certificates that websites use to prove they are who they claim to be. Those certificates are only trustworthy as long as the key eMudhra uses to sign them stays secret. For eight of its own certificates, eMudhra made that key so weak that anyone could work it out, and it went unnoticed for a year and a half.
With such a key, an attacker can create certificates for any website or service, and software such as your browser accepts them as genuine. A forged certificate also allows a hacker to intercept network traffic. In a man in the middle attack, it becomes possible to read or alter the traffic without setting off any alarms. Mozilla, Google, Microsoft and Apple trusted the certificates, as did countless programs that copy their lists.
Extremely weak keys
The security problem concerns so-called intermediate certificates. They link a root certificate in browsers and operating systems to the certificates eMudhra issues to customers. Six were used for websites, two for signing software. Sectigo, another certificate provider, had co-signed six of them via its root AAA Certificate Services.
The secret key should be a random 384-bit number. For these eight, however, the key was a number smaller than 256, or, according to Dennis Jackson of Mozilla, “effectively all zeros except for the last byte”. At most 255 attempts were enough to find such a key.
According to eMudhra, things went wrong when the keys were generated on 30 April 2025. During a test, an error in the code created a second, weaker key pair, which the company used by mistake because of similar labels. eMudhra speaks of “human errors in multiple steps of the process”.
An anonymous security researcher, known only as Wayne, found the keys with paranoid_crypto, a scanning tool from Google, and reported the problem on 17 October. “I spent most of my time on the basic checks that everyone assumed someone else had already done,” he writes.
Browsers protected quickly
Google blocked the certificates in Chrome less than two hours after the report, Mozilla in Firefox within three hours. Microsoft followed on 20 October, Apple on 22 October. eMudhra revoked the certificates on 18 October. Mozilla and Google are also removing the eMudhra root concerned from their lists.
Chrome, Firefox, Edge and Safari also only accept certificates that appear in public logs, the Certificate Transparency logs. Before the report, none of the certificates made with the weak keys appeared there, so users of those browsers could not be attacked.
Much other software does not check those logs and does not verify whether a certificate has been revoked. This includes curl, apps with their own list of trusted certificates, Electron apps such as Slack and Discord, and Java on Debian and Ubuntu. Such software trusts the certificates until it receives an update itself. Nobody knows whether attackers have used the flaw against such tools over the past year and a half. Since the disclosure, the keys are also public, which makes abuse even easier.
eMudhra quits TLS
On 22 October, eMudhra announced that it is leaving the global market for SSL/TLS certificates. Director Venkatraman Srinivasan says the company revoked the certificates within fourteen hours of the discovery, did not issue any certificates with them itself, and that no data was leaked.
He points to rising costs and big players handing out free certificates. According to him, the attention on social media led to “scrutiny that is out of proportion to the place of SSL/TLS in our business”. He calls quitting “the right decision for eMudhra and its shareholders”. eMudhra says nothing about the risk for users of software outside the browser. The company downplays the blunder and views the enormous error through an internal financial lens.
Do you need to do anything?
Administrators are best advised to update operating systems, browsers, libraries and apps as soon as possible. Electron apps are only protected after an update to a patched Electron version, and on Debian and Ubuntu the Java keystore has to be regenerated separately. According to Mozilla, developers who ship their own certificate bundle can block the affected intermediate certificates or remove the roots concerned.
Removing the Sectigo root can make websites that still legitimately rely on it unreachable. Anyone managing Windows devices centrally is better off not using the PowerShell script that blocks the certificates locally. Microsoft distributes the block there via automatic updates.