CERT-In Warns of Compromised eMudhra Certificate Authority Keys
Weakly generated private keys affected eight certificates used in eMudhra’s international trust infrastructure, although its Indian digital signature and eSign services were not affected.
Topics
News
- External Review Finds Flaws in OpenAI’s Agent Monitoring System
- Microsoft AI System Outperforms General Physicians in Diagnostic Tests
- How Sundar Pichai Uses AI Agents to Track Google Operations
- Tech Mahindra Partners With SpaceXSI to Scale AI-Powered Coding
- Barclays to Cut 5,000 Jobs as AI Drives Cost Savings
- CERT-In Warns of Compromised eMudhra Certificate Authority Keys
India’s cybersecurity agency has warned that private keys associated with eight eMudhra intermediate certificate authorities were compromised because they were generated with insufficient cryptographic randomness, creating a risk that fraudulent digital certificates could be issued.
CERT-In said in an advisory issued October 21 that the incident affected eMudhra’s international public-trust infrastructure and not its Indian Digital Signature Certificate and eSign businesses regulated by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology.
The affected P-384 elliptic-curve private keys contained values small enough to be recovered from their public keys. CERT-In said the problem resulted from the key-generation process and did not indicate a weakness in the P-384 cryptographic algorithm itself.
eMudhra said a flaw during an April 2025 key-generation ceremony produced a second set of weak keys alongside the correctly generated ones, with the weaker keys subsequently published to browser trust stores. The company said its infrastructure was not compromised and no data breach occurred.
A holder of the compromised keys could potentially issue fraudulent TLS certificates and impersonate websites where affected certificate chains remained trusted, allowing intercepted traffic to be read or modified. Compromised code-signing keys could similarly be used to create certificates that make malicious software appear trusted.
eMudhra revoked all eight intermediate certificates on October 18. The company said none had issued end-user certificates and only one had been deployed in production.
Google blocked the six affected TLS intermediate keys on October 17 and said no certificates chaining to them appeared in Certificate Transparency logs before the block was imposed. Google is also removing the emSign ECC Root CA – G3 certificate from the Chrome Root Store.
Mozilla separately blocked the certificates through OneCRL and released Firefox 158.0.1 and updated ESR versions for users who might not receive the block automatically.
CERT-In said public disclosures as of October 21 did not establish any confirmed malicious exploitation of the compromised keys.
