Major Tech Groups Reject eMudhra Certificates After Key Compromise
Several major browser and software organizations, including Google, Mozilla, Apple, and the Go project, have stopped trusting certificates issued by India's eMudhra after eight signing keys were compromised. Investigators have not yet determined how the keys were obtained.
Google, Mozilla, Apple, and the Go project have stopped trusting certificates from India's eMudhra after eight signing keys were compromised. Investigators have not established how the keys were obtained, so the origin of the incident remains unclear.
The move highlights a core cybersecurity concern: certificate authorities vouch for digital identities, and when their signing keys are compromised, relying parties may withdraw trust to reduce risk.
The effects could be felt by organizations and individuals that rely on eMudhra-issued certificates for secure websites, software distribution, or authentication, depending on where those certificates are used. Browser and software makers’ distrust may prompt affected users to replace certificates or adjust configurations, potentially causing disruption and eroding confidence in certificate-based trust. Because the cause is not yet known, the longer-term impact may depend on whether the compromised keys enabled misuse before trust was withdrawn.