A serious security lapse involving Bengaluru-based digital certificate company eMudhra has raised concerns worldwide. Researchers found that private encryption keys linked to eight of its intermediate certificates were dangerously weak, creating a possible route for cybercriminals to create fake but trusted website certificates.
The issue is being described as potentially catastrophic because HTTPS certificates are central to online trust. They help browsers confirm that a website is genuine and that information shared with it is encrypted.
What is the eMudhra certificate flaw?
eMudhra is a certificate authority, or CA. Such companies issue digital certificates that browsers such as Chrome, Firefox, Safari and Edge use to verify websites.
In this case, the private keys connected to eight eMudhra intermediate certificates were generated with poor randomness during a key-generation process in April 2025. Because the keys were weak, researchers said they could be recovered from publicly available certificate information.
If an attacker obtained one of these keys, they could potentially sign a fraudulent HTTPS certificate for any website. This could make a fake banking, email, government or e-commerce site appear legitimate in a browser.
Why the risk was serious
The flaw did not automatically mean that attackers could hack every website. An attacker would still need to intercept a user’s internet connection through a man-in-the-middle attack.
However, once in that position, a forged certificate could allow them to impersonate a trusted website. They could then read or alter sensitive information such as passwords, banking details, messages and personal data.
The bigger concern was scale. Because certificate authorities sit at the heart of the web’s trust system, compromised intermediate keys could theoretically be used to target almost any website, not only those using eMudhra certificates.
How tech companies responded
After the issue was reported, eMudhra revoked the eight affected certificates and stopped issuing new certificates under the impacted root. Google, Mozilla, Apple and Microsoft also moved quickly to block trust in the compromised certificates across their browsers and platforms.
Cloudflare also deployed protective measures. The company cautioned that the fix needed to go beyond browsers because many apps, devices and enterprise systems also rely on certificate validation.
Is user data already at risk?
There is no confirmed public evidence that attackers exploited the flaw to issue fake certificates or steal user data. Google also said that no certificates linked to six of the affected intermediates had been logged in public Certificate Transparency records before blocking action began.
Still, security experts warn that the danger may continue for some time. Older browsers, outdated apps, embedded devices and business software may continue trusting revoked certificates until they receive security updates.
What users should do
- Keep browsers, phones, laptops and apps updated.
- Avoid ignoring browser security warnings.
- Use official websites and apps for banking and payments.
- Enable automatic software updates where possible.
- Be cautious while using public or untrusted Wi-Fi networks.
Why it matters
The eMudhra certificate flaw is a reminder that online security depends not only on strong passwords but also on the hidden systems that verify websites. Quick action by eMudhra and major technology companies likely prevented a much larger crisis, but the incident highlights the need for stronger key-generation practices across the certificate industry.
