eMudhra

Stories

Weak eMudhra certificate keys trigger global TLS cleanup

Revoked all eight intermediates; board decided Oct 22 to exit global TLS business; Oct 28 update reports customer transition under way; independent expert review and India's IT ministry panel ongoing

Eight intermediate certificates from eMudhra, an Indian certificate authority, had private keys a computer could guess in under a second. eMudhra first blamed an April 2025 key-generation ceremony, then acknowledged on October 26 that a script error produced the weak keys. Browsers and operating systems are now removing trust in the parent root, not just the eight certificates.

Updated Oct 30

Go blocks trust in eight eMudhra certificate intermediates

Rule Changes

Says eight intermediates from an April 2025 ceremony were compromised; root keys unaffected

Go has released versions 1.27.3 and 1.26.10 that refuse any TLS certificate chain built on one of eight compromised eMudhra intermediate keys. Researchers say the keys were weak enough that an attacker could forge a trusted certificate for any domain and impersonate the site.

Updated Oct 21