Weak eMudhra Certificate Keys Blocked Across Major Platforms

Eight digital certificate keys belonging to eMudhra were weak enough that outsiders could calculate them, according to The Hacker News. The flaw could have allowed someone holding the keys to create certificates that made an impersonated website appear trusted, although there is no disclosed evidence that anyone exploited them.

What happened

eMudhra, an Indian certificate authority that sells certificates under the emSign brand, created the affected certificates during an April 2025 process. The company said that process accidentally produced a weak set of keys, which was then published to browser trust stores instead of the intended set.

Unlike a typical breach, the keys did not need to be stolen from a server. Google’s security teams determined that the keys were generated with too little randomness, allowing them to be calculated from information in the public certificates.

Six of the affected certificates could be used for website security, while two were limited to signing software code. A researcher reported the problem on October 17. Chrome and Firefox blocked the website-related certificates within hours, and eMudhra has revoked all eight.

Apple blocked the certificates on October 19, followed by Microsoft on October 20. Google also delivered an equivalent block to Android devices through Google Play Services. Chrome and Firefox distributed their protections through automatically downloaded certificate-revocation lists, so those browsers did not require a normal update or restart for this specific block.

Who is affected

The issue matters broadly because certificate authorities help browsers and other software decide whether a secure connection or signed program should be trusted. However, The Hacker News reported that no website certificates connected to the six affected intermediates appeared in Certificate Transparency logs before Chrome blocked them. Whether the weak keys were misused in another way has not been disclosed.

People using current Chrome, Firefox, Apple, Microsoft and Android security services should have received platform-level protections. The status of every other program that performs its own certificate checks has not been disclosed. Developers and small offices running Go-based software should also note that Go addressed the keys in its October 20 security releases.

What to do now

1. Keep automatic security services enabled. Chrome and Firefox retrieve their certificate-blocking lists automatically. Avoid disabling standard browser security settings that allow these protections to arrive.

2. Check that your device is receiving platform security updates. Apple, Microsoft and Android have issued blocks, with Android receiving its protection through Google Play Services. Install any pending system or security-component updates offered by your device.

3. Do not manually add eMudhra or emSign certificates to a trusted-certificate store. The eight affected certificates have been revoked, and manually trusting old copies could bypass protections supplied by the platform.

4. Update Go installations used by a small office or home server. Use the October 20 Go security release appropriate for the installed branch. The affected version numbers were not included in the source text.

5. Ask vendors about certificate handling for separately maintained software. If an appliance or business application uses its own certificate store, ask whether it has blocked the eight eMudhra keys. Coverage for every such product has not been disclosed.