An Indian digital trust company, eMudhra, is facing an international cybersecurity challenge after the private keys associated with eight digital security certificates were found to be dangerously weak. The discovery has prompted Google, Mozilla, Apple, Microsoft and other technology companies to take steps to block the affected certificates and protect users from potential online impersonation.
The incident has raised concerns about the security systems that help people distinguish genuine websites from fraudulent ones. Although no confirmed misuse of the affected keys has been publicly established, the vulnerability could have allowed attackers to create fake security certificates and impersonate legitimate websites.
The issue came to light on October 17, 2026, when security researchers reported that private keys associated with eight intermediate certificate authority certificates issued by eMudhra had been compromised. Google and Mozilla subsequently blocked the affected certificates, while other technology companies began strengthening their security measures.
According to eMudhra’s statement on October 21, the affected certificates were created during a key generation ceremony on April 30, 2025. A flaw in the process generated a second set of weak cryptographic keys alongside the original, stronger keys.
The company said the process involved hardware security modules designed to protect cryptographic keys. However, an error during a key-handling operation resulted in the weak keys being published in browser trust stores.
The incident demonstrates how a flaw in a specialised security process can have consequences extending beyond the organisation responsible for it. Digital certificates issued by trusted authorities are an important part of the infrastructure that supports secure internet communication.
Digital certificates help browsers verify that a website is what it claims to be. They also support encrypted connections through Transport Layer Security (TLS), which protects information exchanged between a user’s device and a website.
Certificate authorities issue and manage these credentials. Their role is critical because browsers and operating systems rely on trusted certificate authorities to establish the identity of websites and services.
If an attacker obtains the private key of a trusted intermediate certificate authority, the attacker may be able to create fraudulent certificates that appear legitimate to systems that continue to trust the compromised authority.
Such certificates could potentially be used to impersonate websites, including services handling sensitive information. Depending on the circumstances, an attacker positioned to intercept a connection could attempt to read or modify the data exchanged between a user and a server.
The eight affected eMudhra certificates included six intended for website security and two associated with code signing, which helps software users and systems verify the origin and integrity of applications.
The seriousness of the incident lies in the possibility that weak cryptographic keys could undermine the trust placed in digital certificates, rather than in evidence of a confirmed large-scale attack.
Google, Mozilla and other technology companies respond
Google’s Chrome Root Program acted after receiving a report on October 17. It blocked the affected intermediate certificate keys through a security update that did not require most users to install a new browser version or restart Chrome.
Google also extended protection to Android devices through Google Play Services. It said its investigation found no certificates linked to six affected intermediate authorities in Certificate Transparency logs before the blocking action. These logs publicly record the issuance of website certificates and help security researchers identify suspicious activity.
Mozilla took similar action, blocking the affected certificates in Firefox through its OneCRL certificate-revocation system. The protection reached users with standard configurations within hours of the report. Mozilla also announced updates for certain Firefox desktop and Android versions, along with changes to its certificate trust store.
Apple and Microsoft also took steps to distrust the affected certificates. Cloudflare, which provides internet infrastructure and cybersecurity services, said it had deployed measures across its systems and had not identified active exploitation of the issue on its services.
Google has additionally announced plans to remove the related emSign ECC Root CA – G3 certificate from the Chrome Root Store. The change is expected to roll out to supported devices from October 27, 2026, Pacific Daylight Time. Some legitimate websites that rely on certificates linked to this root may stop functioning in Chrome unless their operators migrate to certificates issued under another trusted certificate hierarchy.
eMudhra has maintained that the incident is restricted to eight intermediate certificate authorities used in its global website security business. It said its root certificate authority private keys and other intermediate authorities were not affected.
The company also stated that none of the eight affected intermediate authorities had issued certificates to end users, websites or other entities, a position it said was supported by its internal analysis and publicly available certificate records.
In a separate statement, eMudhra said its Indian digital signature and eSign services remained unaffected. It also said there had been no compromise of its infrastructure or data breach.
These assurances are important because eMudhra provides digital trust services, including digital signature certificates, electronic signing solutions and digital identity products. However, its investigation into the cause of the weak keys and the effectiveness of its security controls remains ongoing.
The immediate priority is to ensure that browsers, operating systems, applications and other software no longer trust the affected certificates. Organisations using certificates connected to the affected root may also need to review their configurations and replace certificates where necessary.
The incident highlights the importance of strong cryptographic key generation, independent security reviews and effective certificate monitoring. Even when encryption technology is sound, mistakes in implementation or key management can weaken the protection it is intended to provide.