Google, Mozilla, Apple and Microsoft block eMudhra certificates over key flaw
Major browser companies have blocked certificates linked to Bengaluru-based eMudhra. Eight of its intermediate certificate-authority keys were generated with too little randomness, which made them potentially recoverable by attackers. CERT-In issued an advisory on 21 October.
Practice 2 MCQsMains
Why in news
Websites prove their identity through digital certificates issued by certification authorities, in a hierarchy of root, intermediate and end-user certificates. A weak key at an intermediate level could let attackers issue fake certificates, impersonate websites or sign malware.
Prelims pointers
- Of the eight affected certificates, six were for authenticating websites (TLS) and two were for signing software. The flaw was reported to browser companies on 17 October by an independent researcher.
- eMudhra traces the flaw to a key-generation exercise on 30 April 2025. It says only one affected authority was in production, and none had issued end-user certificates.
- Google said no website certificates chaining to the affected authorities appeared in Certificate Transparency logs before it blocked them.
- In India, certifying authorities that issue digital signature certificates are licensed by the Controller of Certifying Authorities (CCA) under the IT Act, 2000. Other licensed authorities include Safescrypt, Capricorn and nCode.
- eMudhra is India's largest certifying authority, with about 38% of the digital signature market by value. It says its Indian digital signature and eSign businesses run on separate infrastructure and were not affected.
Mains angle
Internet security rests on trust in a few certification authorities. One lapse can undermine HTTPS, so key management needs strict audits and fast revocation.
10
