Vulnerabilities
eMudhra to leave SSL/TLS market after weak CA keys found
eMudhra will exit the SSL/TLS certificate business after researchers found eight of its certificate authority keys were easily guessable. Major browsers have blocked trust in the affected certificates.
Ross Grant3 min read
The short version
eMudhra, a company that issues website security certificates, is leaving the business after researchers found that eight of its secret keys were easy to guess. This could have allowed attackers to create fake certificates that browsers might trust. Major web browsers have already blocked these certificates. If your systems use eMudhra certificates, you should replace them as soon as possible.
By the numbers
- 8compromised intermediate CA keysHackread
- 30,800unexpired certificates in the affected root hierarchy (not all compromised) as of October 21Hackread
- 1%eMudhra's global SSL/TLS business share of company revenueHackread
What happened?
eMudhra will leave the SSL/TLS certificate market after eight of its intermediate certificate authority private keys were found to be easily guessable, according to Hackread. Researchers and Mozilla were able to recover the keys quickly, prompting major browsers to block trust in the affected certificates. eMudhra said the issue was due to a flaw in its key-generation process and is offering free replacements.
What was taken
No customer data or website secrets were reported stolen. The issue was with eight private keys used by eMudhra's intermediate certificate authorities (CAs). These keys are supposed to be secret and unpredictable. Instead, researchers found they were based on small, easily guessable numbers. This meant attackers could have created fake certificates that browsers might trust, but there is no evidence this happened before the keys were blocked [Hackread] (opens in a new tab).
How the flaw works
Certificate authorities issue digital certificates that prove a website's identity. To do this securely, they use private keys that must be impossible to guess. In April 2025, eMudhra generated eight intermediate CA keys using small numbers, making them easy to recover. Security researcher Scott Helme showed he could recover all eight in less than a second. Mozilla, which manages trust for Firefox, also independently recovered the keys. The affected keys included six for TLS (website security) and two for code signing. All were cross-signed by Sectigo’s AAA Certificate Services root in May 2025.
The response
eMudhra said the problem was due to a flaw in its key-generation process and is investigating the root cause. The company will leave the global SSL/TLS certificate market, which made up about 1% of its revenue. eMudhra cited rising compliance costs and data sovereignty rules as additional reasons for the exit. It is offering free replacement certificates through partners and will keep revocation and status services running until all certificates expire or are replaced.
Major browsers acted quickly. Mozilla blocked the affected intermediates using OneCRL and is removing trust in the root certificate that signed them. Google Chrome scheduled removal from its root store for October 27. According to Google’s Certificate Transparency logs, no website certificates had been issued using the compromised intermediates before they were blocked. eMudhra said seven of the eight intermediates were never used in production, and the last one had not issued any certificates.
What you should do
The risk is not limited to browsers. Java keystores, container images, load balancers and mutual TLS setups may trust these certificates independently. Java, for example, does not check certificate revocation by default. Azul, a Java platform provider, has released updates to block the compromised certificates and published workaround instructions for environments that cannot update right away. Security teams should review where eMudhra certificates are trusted, apply vendor updates and migrate critical services to a trusted certificate authority.
Has this happened before?
This is not eMudhra’s first certificate management issue. In May 2025, Mozilla’s public records show eMudhra published invalid certificate revocation lists for six intermediates. Mozilla has questioned why that earlier investigation did not uncover the weak key generation affecting multiple authorities.
Why it matters
Weak certificate authority keys can undermine the security of the entire web, allowing attackers to impersonate trusted sites. Even if browsers act quickly, other systems like Java servers may still trust the compromised certificates unless updated. This incident highlights the importance of strong key generation and regular audits for certificate authorities.
Key points
- Eight eMudhra CA keys were easily guessable, risking fake certificate creation.
- Major browsers have blocked trust in the affected certificates.
- eMudhra is exiting the SSL/TLS certificate market and offering free replacements.
- Java and other systems may still trust the compromised certificates unless updated.
- Earlier certificate management issues at eMudhra were not fully addressed.
Sources
Hackread
Reference
