What is eMudhra, and what does it do?
eMudhra is a Bengaluru-based company, a licensed Certifying Authority (CA) in India under the IT Act, and it has the authority to issue digital certificates. The company runs two distinct businesses: one is digital signature certificates (DSCs) and eSign services, and the other is the website (TLS/SSL) and code-signing certificates sold under the emSign brand. As per the company, it has issued over 60 million digital certificates.
Why are its digital certificates important for your online activity?
A digital certificate works as an identity card for websites. Therefore, your browser only trusts a site’s certificate issued by a CA that the browser, phone, or operating system already trusts. When that check passes, you see the padlock and your connection to the site is encrypted.
Each of these certificates holds a private key: a secret number that only the owner has access. Whoever holds the key can sign certificates that browsers will accept. Now, a compromised private key means the secret is no longer secret, and anyone can act as that CA. This is why the eMudhra certificate vulnerability was considered a major incident.
Must read: eMudhra certificate alert: How to update Windows, macOS and Linux devices for better security
After the incident broke, Mozilla warned that such keys could let attackers issue fraudulent HTTPS certificates for websites, directly impacting users' businesses.
What happened in the security scare?
On April 30, 2025, eMudhra created a batch of intermediate certificates during a key generation ceremony, in which eight of them were affected. On October 17, A researcher known as Wayne reported that the private keys of eight eMudhra intermediate certificates were compromised. Chrome and Mozilla. Both the browsers and Apple blocked the certificates, and eMudhra says it has revoked all eight on this date.
Google said that the eight eMudhra digital certificates were compromised because the private keys were generated using insufficient randomness, making them extremely easy to guess or recover.
In a statement, eMudhra says said that the system created two set of keys alongside the strong ones, and the weak set, and both got published to browser trust lists. The keys were made on certified hardware security modules, it says. The flaw went unnoticed for about 18 months, through two independent audits, and the root cause is still under investigation.
Must read: eMudhra certificate alert: How to update Android and iPhone apps to improve your device security
Could your personal data or online accounts be at risk?
As of now, theft of user data has been reported after the incident. eMudhra says its infrastructure was not compromised and no data was breached. It says only one of the eight was ever used in production, and that none of them issued a certificate to any website. However, CERT-In says the public disclosures do not establish confirmed malicious use of the keys as of October 21, according to The Hacker News.
What should you do now to stay safe?
- It is advised that users keep their browser and device updated. Chrome and Firefox received the block in the background without an update. Firefox on Android got a follow-up fix (158.0.2), and Firefox 158.0.1 covers installations where the background block list is disabled by policy or blocked on the network. Google says Android devices received the block via Google Play Services and a restart picks it up immediately.
- Do not click through certificate warnings. A warning could mean a legitimate site is mid-migration to a new certificate after the root’s removal, or something more serious.
- Be careful of unsolicited links asking you to log in.
- As of now, one of the browser or company advisories asked everyday users to change passwords.