Eight Weak eMudhra Keys Trigger a Worldwide Security Cleanup

The private keys were so small that security researcher Scott Helme recovered all eight in under a second. On Wednesday, October 21, Indian certificate company eMudhra said a flaw in its key-making process created weak keys alongside the intended strong ones. It said its systems and data were not breached, and Indian digital-signature services were unaffected. ^1,2

Those eight keys were made on April 30, 2025, for certificates that sit between trusted authorities and website certificates. Six could issue website certificates; two were for signing software. The weak keys appeared in browser trust records. On October 17, a researcher known as Wayne alerted major trust programs and proved control by signing a warning message. eMudhra says a script error created a second set of keys. They were chosen because their labels looked like the correct ones. ^1,4,11

That warning led Chrome and Firefox to block the keys on October 17, followed by Apple on October 19 and Microsoft on October 20. Someone with one of the keys could make a fake certificate for any website, but would also need to intercept or redirect a user’s connection to impersonate it. No evidence has emerged that the keys were used to issue fake website certificates. Still, some programs do not check lists of canceled certificates, so older systems, connected devices and software with their own certificate records may need updates. ^2,3,4

Those updates are now the practical next step. Go released versions 1.27.3 and 1.26.10 on October 19, which block the eight keys, while browser makers and other software providers have also added protections. eMudhra says the affected global TLS business brings in about 1% of its revenue. The company is working with customers on replacement certificates and investigating how the error happened. ^1,4,11