eMudhra CA Keys Compromised: Chrome, Apple Block 8 Certificates

Private keys for eight intermediate certificate authorities run by the Indian company eMudhra were generated so poorly that researchers could recover them within seconds, and Chrome, Firefox, Apple and Microsoft have since blocked the certificates. Google’s Chrome Root Program received the report on 17 October and said the keys were created with weak randomness, so anyone holding them could forge HTTPS certificates for any website that still trusts these authorities.

Websites on the emSign Root Face a 27 October Deadline

Google plans to remove the emSign ECC Root CA – G3 from the Chrome Root Store, and the change is expected to reach devices on 27 October. Operators whose site certificates chain to that root must install a certificate from another authority before then, or Chrome will stop trusting their sites. Google said ordinary Chrome users did not need an update because the intermediates were blocked remotely on 17 October. Android devices received an equivalent update on 19 October. The Register reported that some other software still needs updating.

Six Website Certificates, Two for Code Signing

Business Standard reported that six of the eight certificates were for website security and two for code signing. eMudhra said the certificates came out of a key-generation ceremony in April 2025, that one was deployed in production, and that none had issued certificates to end users, websites or other entities. It said its root keys and other intermediates are not affected and that its investigation continues. Google said no fraudulent certificates from these authorities appeared in public Certificate Transparency logs before the block.

Security researcher Scott Helme told The Register that one of the keys “is the number 4”; he said other recovered keys were 56 and 115. The Register said eMudhra had not answered its questions.

Chrome Reviews the Rest of eMudhra’s Certificates

Google said it is checking whether eMudhra’s remaining certificates should stay in the Chrome Root Store. eMudhra is a licensed Certifying Authority under the Information Technology Act, 2000, according to Business Standard. None of the reports IPB reviewed mentions a statement from the Controller of Certifying Authorities or the IT Ministry. Chrome’s removal of the emSign ECC root is due on 27 October.

Earlier IPB coverage of data security includes the SBI data breach involving 3,897 customer records. More reports are in Daily Updates.

Source: Google Security Blog on the eMudhra intermediate CA certificates. Also based on reporting by Business Standard and The Register.

Image: The Register.