Browsers Drop Trust in eMudhra Certificates After Weak Encryption Keys Found

Indian digital security firm eMudhra is exiting its global business of issuing website security certificates. Major browser makers including Google, Apple and Microsoft stopped trusting its SSL/TLS certificates, which encrypt data sent between users and websites to stop it being intercepted. The company's customers range from Infosys and TCS to government agencies, and its certificates protect sites such as India's income-tax portal.

An independent researcher found over the weekend that several of eMudhra's main certificates could be attacked. The company said the flaw went undetected for 18 months and passed two rounds of audits. Co-founder Kaushik Srinivasan told Reuters that eight keys generated in April last year were mistakenly shortened by its software, making them significantly weaker and easier to break. eMudhra said it has withdrawn eight certificates, and maintains its infrastructure was not compromised and no data was breached. India's Computer Emergency Response Team said some eMudhra intermediate certificates had been compromised.

Experts warned of wider effects. Lukasz Olejnik, a visiting senior researcher at King's College London, noted that a single compromised certificate authority can impersonate any website. Browsers quickly blocked the affected certificates, but less frequently updated internet-connected devices could remain exposed. Olejnik said millions of older devices may stay at risk for years, or forever, because they will still trust those certificates.