Google and Apple Block eMudhra Certificates After Key Flaw
Google, Apple, Mozilla, and Microsoft blocked eight eMudhra intermediate certificates after a cryptographic flaw allowed private keys to be recovered almost instantly.
Major software providers including eMudhra, Google, Apple, Mozilla, and Microsoft have blocked eight intermediate certificate authority (CA) certificates after a critical cryptographic flaw exposed their private keys. A security researcher discovered on October 17 that keys generated during an April 2025 ceremony lacked sufficient randomness, containing values smaller than 256 that allowed private keys to be recovered almost instantly, even by AI agents.
Of the affected certificates, six were for TLS website issuance and two were for code signing. The vulnerability could have enabled attackers to impersonate legitimate websites and intercept encrypted communications. Mozilla and Google blocked the certificates on October 17, followed by Apple on October 19 and Microsoft on October 20. Cloudflare also implemented network-wide protections.
eMudhra revoked the certificates on October 18, attributing the incident to a script error and human failures during the key lifecycle integrity process. The company stated that only one intermediate was deployed in production and that its root CA keys and Indian Digital Signature Certificate businesses remain secure on separate infrastructure. While the affected global TLS business accounts for approximately 1% of company revenue, eMudhra warned of unquantifiable reputational risks. Following the news, the company's stock fell 18-20% on the NSE.
India's Computer Emergency Response Team (CERT-In) issued an advisory, though the Internet Freedom Foundation criticized Indian regulators for a lack of timely public communication regarding the breach.
