Eight compromised TLS intermediate certificates issued by India-based certificate authority eMudhra have triggered an urgent security response, raising concerns about the security of HTTPS connections across the internet.
The compromised cryptographic keys could allow attackers to create fraudulent certificates for websites they do not control, potentially enabling them to impersonate trusted online services.
The issue was reported to browser security teams on October 17, 2026, and publicly disclosed on October 20. Investigators found that the private keys associated with the eight intermediate certificates had been generated with dangerously weak randomness, making them vulnerable to recovery. These certificates are connected to trusted certificate authority systems used by major browsers and other software to verify the identities of websites and services.
The discovery prompted major browser vendors and technology companies to move quickly to block the affected certificates. Google confirmed that Chrome had deployed protections, while Mozilla added the certificates to Firefox’s blocklist and released additional security updates. However, securing the broader internet remains a challenge because many applications, Linux systems, embedded devices, Internet of Things products, and container images rely on separate certificate stores or may not receive updates automatically.
eMudhra said the incident was limited to the specific intermediate certificates involved and did not affect its root certificate authority private keys or other intermediate authorities. The company also reported that none of the affected certificates had issued end-entity certificates, a finding supported by publicly available certificate transparency records. Nevertheless, the compromised keys created a serious potential security risk while affected systems continued to trust them.
Cryptography engineer Filippo Valsorda warned Ars Technica that removing the affected certificates from every vulnerable system could become a massive cleanup operation, potentially exceeding the work required to address the Heartbleed vulnerability discovered in 2014. That earlier OpenSSL flaw triggered widespread security updates, certificate replacements, and credential changes across the internet. The eMudhra incident presents a different challenge because fixes must reach a diverse range of devices and software, including systems that may no longer be actively maintained.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Although no malicious use of the compromised keys had been identified in certificate transparency records at the time of the initial reports, that does not rule out every possible misuse. Exploitation would generally require an attacker to intercept a victim’s connection and use a fraudulent certificate that the victim’s software still trusts. Systems that have not received the necessary security updates therefore remain a concern.
