eMudhra certificate flaw exposes weak private keys, prompting browser and software blacklist updates

A major certificate security incident involving Indian certificate authority eMudhra has triggered emergency action across browsers and software ecosystems. Security researchers found that eight intermediate certificates issued by eMudhra were generated with a severe implementation flaw, leaving their private keys with effectively tiny values such as 4, 56, and 66. According to the report, those keys could be fully broken in under a second, undermining a core layer of HTTPS trust. Because intermediate certificates sit at a critical point in the HTTPS trust chain, exposure of their private keys could allow attackers to forge trusted HTTPS certificates and carry out man-in-the-middle attacks against banks, email services, or other trusted websites, intercepting or altering user traffic. The issue was attributed not to an outside intrusion, but to a catastrophic error in eMudhra’s certificate generation process. Chrome, Firefox, Apple, and Microsoft have released security updates to blacklist the eight affected intermediate certificates. eMudhra has also revoked them. Go, Python, Rust, and Electron have pushed updates as well because many software stacks rely on bundled certificate trust stores. So far, security agencies have not found evidence that the weak keys were used to issue forged certificates.