Indian Computer Emergency Response Team (CERT-In)

New Capabilities

Issued an advisory on the compromise

Eight intermediate certificates from eMudhra, an Indian certificate authority, had private keys a computer could guess in under a second. eMudhra first blamed an April 2025 key-generation ceremony, then acknowledged on October 26 that a script error produced the weak keys. Browsers and operating systems are now removing trust in the parent root, not just the eight certificates.

Updated Oct 30