[CLSTR]
< Back to all clusters
[TECHNOLOGY] · India · 34 sources

started · updated

Part of situation: eMudhra certificate authority security compromise (3 clusters)

eMudhra certificate flaw triggers global security response

eMudhra digital certificates cryptographic vulnerability SSL/TLS cybersecurity

A critical security vulnerability involving eight intermediate certificate authority (CA) certificates from the Indian firm eMudhra has prompted emergency actions from major technology providers. The flaw stems from cryptographically weak private keys—some as simple as the integers 4, 56, or 115—which were generated due to a bug in a key configuration script during a ceremony in April 2025.

Because these P-384 elliptic-curve keys lack sufficient entropy, they can be recovered in seconds, potentially allowing attackers to forge certificates, impersonate legitimate websites, and intercept encrypted HTTPS traffic. Major browser makers including Google Chrome, Mozilla Firefox, Apple, and Microsoft have implemented blocks to mitigate the risk.

While the incident affects eMudhra’s international SSL/TLS and code-signing business, the company stated that its domestic Indian Digital Signature Certificate (DSC) and eSign services remain unaffected. Following the incident, eMudhra announced its decision to exit the global SSL/TLS certificate market, citing high operational complexity and reputational risks.

Security experts warn that while browsers are largely protected, risks remain for software environments that do not check certificate revocation lists, such as certain IoT devices, Linux distributions, and programming environments like Python, Go, and Node.js.

Entities

Apple · Cloudflare · Google · Google Chrome · Microsoft · Mozilla · Sectigo · eMudhra

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Falha em certificados digitais ameaça segurança HTTPS [itshow.com.br]
EMudhra Intermediate CA Certificates Compromised [cybernoz.com]
MeitY launches probe into eMudhra certificate incident; CERT-In issues mitigation advisory [bhaskarlive.in]
CertiK Warns eMudhra Fixes Could Expose Crypto Bots [www.cryptobreaking.com]
印度憑證機構 eMudhra 中繼 CA 私鑰外洩，Chrome / Firefox 即時封鎖、Go / Python certifi 等緊急修補 | TechNews 科技新報 [infosecu.technews.tw]
Osiem kluczy prywatnych firmy eMudhra, wystawiającej certyfikaty stron, złamano w mniej niż sekundę [osnews.pl]
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds [scotthelme.co.uk]
Chaves fracas da eMudhra comprometem certificados digitais [www.spacemoney.com.br]
eMudhra to exit global SSL/TLS certificate business after security incident - tennews.in: National News Portal [tennews.in]
Explained: What is the eMudhra certificate compromise about and should you be worried? [thefederal.com]
EMudhra: Private Keys von 8 Intermediate-CAs berechenbar - Trust Stores prüfen [administrator.de]
Weak encryption certificates could have let hackers easily spoof websites [www.cybersecuritydive.com]
MeitY forms special team to probe eMudhra certificate security incident: Sources | Business [www.devdiscourse.com]
Mit dem geknackten eMudhra-Schlüssel stellt mitmproxy Zertifikate für jede Website aus [www.drweb.de]
The eMudhra CA Compromise: How to Audit and Patch Linux [www.fosslinux.com]
CyberPeace advisory on e-Mudhra urges updates before Oct 27 deadline [newsable.asianetnews.com]
eMudhra shares crash 20% after security flaw hits TLS certificates [www.newsbytesapp.com]
eMudhra's Bad Keys, and Why I Still Won't Decrypt Your Traffic [routerjockey.com]
Una clave de seguridad era el número 4: la falla que puso en alerta a internet y puede afectar a millones de dispositivos [www.somosjujuy.com.ar]
Hindistan'da küçük bir şirket, küresel çapta internet krizi yarattı [tr.euronews.com]
eMudhra Shares Crash 13% on Cybersecurity Flaw; Here's What Investors Should Watch Next [tradebrains.in]
eMudhra CA compromise fixes available | Ubuntu [ubuntu.com]
Internet on Alert as AI Uncovers Critical Flaws in PHP Used by 70% of Websites [analyticsindiamag.com]
Sicherheitsvorfall bei Mudhra: Kompromittierte Schlüssel erlaubt Fälschen von Zerti­fikaten [www.computerbase.de]
eMudhra kills its certificate business after researchers cracked its private keys in under a second [cyberscoop.com]
eMudhra To Exit Certificate Business As Security Flaw Triggers Distrust [inc42.com]
Cloudflare warns fixing botched eMudhra certs goes beyond browsers [www.itnews.com.au]
eMudhra’s Weak Security Keys Trigger Global Browser Ban; Centre Orders Probe [www.news18.com]
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable [thehackernews.com]
Govt Forms Special Team To Probe eMudhra Security Breach - What Was The Impact On Indian Wesbites? [www.timesnownews.com]
Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains [9to5mac.com]
CertiK Warns Crypto Apps Remain at Risk From eMudhra Flaw [cointelegraph.com]
Python requests and Node fetch still trusted eMudhra's compromised CAs on my machine. A 151-line check [dev.to]
eMudhraで侵害された8つの認証局すべての秘密鍵はなんとたった「1バイト」で秘密鍵の1つは「4」、Mozilla・Microsoft・Apple・Chromeのルートプログラムや多くの下流トラストストアによって信頼されているルート証明書に連鎖 [gigazine.net]