eMudhra's guessable certificate keys opened door to forged HTTPS sites
Eight intermediate certificates from Indian certificate authority eMudhra were protected by private keys so weak that they could be recovered from public certificates almost instantly. A researcher found the issue on October 17 and demonstrated control of each key, leading Mozilla to disclose the problem on October 20. Because the certificates chain to roots trusted by major browsers and operating systems, attackers could have created forged HTTPS certificates and impersonated websites.
The affected intermediates belonged to a set of 24 that eMudhra created on April 30, 2025; six were for TLS and two for code signing, and Sectigo cross-signed the eight in May. A faulty ceremony script generated a second, weaker key set with similar labels, and staff selected those by mistake.
Researcher Wayne found the issue through a CCADB check on October 17, signed a test message with every key, and alerted major browser vendors and eMudhra. Mozilla's Dennis Jackson disclosed it October 20. eMudhra revoked the certificates October 18, and later said about 30,000 customer certificates would need replacement.
The incident could affect anyone relying on HTTPS for sensitive transactions, because forged certificates might let attackers impersonate sites and intercept or alter traffic. Organizations using eMudhra-issued certificates may face replacement work and temporary disruption, while users on devices or applications that do not promptly check revocation could remain exposed longer. The broader trust ecosystem may also face scrutiny over how certificate authorities generate and audit signing keys.