Google, Mozilla, Apple block certificates by Indian company over security flaw
Bengaluru-based digital identity and cybersecurity company eMudhra has revoked eight intermediate certificates after their private keys were found to be weak, prompting Google, Mozilla, Apple and Microsoft to block the affected certificates.
"Eight intermediate (issuing) CAs in our Global TLS business were revoked because their published keys were weak," the company said, adding that it was investigating the issue.
A certificate authority (CA) is an organization that browsers such as Chrome, Firefox and Safari rely on to verify website identities and establish secure connections.
The flaw could have allowed attackers to impersonate legitimate websites using fraudulent certificates and potentially intercept or manipulate supposedly secure online communications. However, no evidence of such misuse has been publicly confirmed.
The flaw originated in a key-generation process in April 2025 that produced weak private keys, the company said.
Media reports citing security researcher Scott Helme said one of the keys was the number four, rather than a cryptographically secure, randomly generated number, while others were also easily guessable.
India's Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the incident.
"A special team has been constituted to investigate the matter," the ministry said in a statement on X.
A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter.
— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026
