समाचार Samāchār · Tech & AI · 22 October 2026

Browsers distrust eMudhra after eight certificate keys prove guessable

Google, Mozilla, Apple and Microsoft blocked eight intermediate certificates from the Chennai certificate authority. Its board voted to leave the global SSL/TLS business.

On the night of 17 October a researcher told Apple, Google, Microsoft, Mozilla and eMudhra that the private keys for eight eMudhra intermediate certificates could be recovered. Mozilla engineer Dennis Jackson said each key was a number below 256 and could be guessed almost at once.

Google blocked the six website certificates within about two hours and Mozilla within three. Apple and Microsoft followed on 19 and 20 October. Chrome is due to remove the eMudhra root on 27 October.

eMudhra said a script fault during a key transfer in April 2025 created the weak keys, that its systems were not breached and that the keys never issued customer certificates. About 30,000 certificates, many at universities, have to move. On 22 October its board approved leaving global SSL/TLS, about 1 per cent of revenue. Its Indian digital signature and eSign services run on separate systems and were not affected. The shares fell 20 per cent.

What a founder takes from it: Know who signs your certificates and make sure renewals can run outside the normal window. Trust can be withdrawn in hours.