Global online security scare after certification authority is compromised
Key Points
- Indian certificate authority eMudhra has confirmed eight of its private keys for its intermediate certificates have been compromised.
- This news has prompted a global security scare, as the CA has issued more than 60 million certificates and has been in trusted browser lists since 2025.
- Instead of using 384-bit random numbers as private keys, the keys in question were short, easily hackable numbers — one was simply the number '4'.
- Cloudflare, Google, Mozilla, and many others have responded to mitigate the security threat and ensure poisoned certificates are no longer in trusted lists.
Several private keys used by an Indian certification authority have been compromised, prompting a global security response.
It has been discovered that private keys associated with eight intermediate certificates issued by eMudhra, a certification authority (CA) based in India, have been compromised.
CAs sign and issue digital certificates for protocols such as HTTPS, acting as a trusted authority that provides the infrastructure for secure connections over the internet.
In the case of eMudhra, security researchers found that private keys used to sign the certificates issued by the company were extremely weak, allowing attackers to issue fraudulent HTTPS certificates for websites they do not control.
eMudhra has issued more than 60 million certificates, which are relied upon by browsers, operating systems, and service providers such as Google, Mozilla, Cloudflare, and many others.
The CA said that eight of its intermediate CAs published weak keys to the browser root stores which allowed them to be easily compromised. These keys were only a few bits in length, as opposed to the 384-bit random number used by the P-384 standard that normally secures these certificates.
According to an investigation by security researcher Scott Helme, the private keys used by eMudhra were laughably short and easy to compromise. Instead of 384-bit random numbers, one was simply the number ‘4’.
As the private keys were so unsecure, Helme was able to brute force the keys used by the intermediate certificates in a couple of seconds, an act which any malicious actor would have been able to accomplish to subsequently issue fraudulent certificates that appear as trusted.
Cloudflare describes the security implications of this compromised CA most directly:
“Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic,” the company said on its website.
“This is a serious security incident with implications across the Internet.”
Browsers, service providers, and a host of other companies have acknowledged and are responding to the issue, and eMudhra itself has issued a statement confirming the fact that its private key generation process was flawed.
eMudha said that the flawed root keys had withstood two years of independent audits and have been in browser trust lists since the middle of 2025.
It said that there was no compromise of its infrastructure or data, and that this incident had no connection with its Indian Digital Signature Certificate and eSign businesses.
The company’s share price has plummeted since the news of the incident broke, falling by 20% overnight.
