Indian digital certificate provider eMudhra is facing scrutiny after security concerns emerged over weak cryptographic keys associated with eight of its digital certificates. The issue could potentially allow attackers to create fraudulent certificates for websites and intercept or manipulate information exchanged between users and legitimate websites.
Google, Apple, Microsoft and Mozilla have blocked the affected certificates to prevent their products from trusting certificates linked to the compromised keys. According to reports, Cloudflare identified the issue at around 10:30 PM IST on October 19. The company reportedly found no evidence that the affected certificates had been exploited on its own services.
The incident has raised concerns about the security of digital certificates and the measures required to protect users from potential online attacks.
What Is the eMudhra Certificate Security Issue?
eMudhra is an Indian digital trust and cybersecurity company that issues digital certificates used for website authentication and secure online communication.
Digital certificates act like identity documents for websites. When a user visits a website, the browser checks its certificate to help establish whether the site is genuine. This verification also supports the creation of an encrypted HTTPS connection, which helps protect information exchanged between the user and the website.
If a certificate authority’s security keys are compromised or insufficiently protected, attackers may be able to misuse them to create fraudulent certificates. Such certificates could make malicious websites appear legitimate or potentially enable interception of encrypted communications under certain circumstances.
The concerns surrounding eight eMudhra certificates have therefore drawn attention to the importance of secure key generation, certificate management and timely action by browser developers.
What Has eMudhra Said About the Incident?
eMudhra has acknowledged the security issue and said it is investigating a specific group of intermediate certificate authority (CA) certificates created during a Key Generation Ceremony (KGC) in April 2025 within its public trust infrastructure.
In its statement, the company said the incident was restricted to the identified intermediate CA certificates and did not affect its root CA private keys or other intermediate CAs.
The company also stated that it had taken steps to contain the affected certificates. It is working with browser developers and other operators to reduce the risk of potential misuse.
The investigation remains ongoing, and eMudhra has said it will provide further updates as more information becomes available.
How Could the Incident Affect Internet Users?
The primary concern is that fraudulent digital certificates could be used to impersonate legitimate websites or facilitate attacks on online communications. The potential impact depends on whether affected certificates are misused and how effectively browsers and other software prevent them from being trusted.
The decision by Google, Apple, Microsoft and Mozilla to block the identified certificates is intended to prevent their products from accepting certificates associated with the affected keys.
Cloudflare reportedly found no evidence of exploitation on its own services when it identified the issue. However, that finding does not establish whether the certificates were used elsewhere.
What Should Users Do Now?
Users should keep their web browsers, operating systems and applications updated so that security changes and certificate-blocking measures can take effect.
They should also remain cautious when visiting unfamiliar websites, responding to unexpected links or entering sensitive information online. The incident highlights the importance of maintaining updated software and following official security advisories when certificate-related vulnerabilities are reported.
Disclaimer: This article is intended for general informational purposes only and is based on the reported incident and statements attributed to eMudhra. The investigation is ongoing, and the full technical impact has not been independently established here. Users and organisations should refer to official advisories from eMudhra, browser developers and relevant security authorities for verified updates and recommended actions.