CERT‑In issued an advisory on 21 October warning that attackers could exploit weak cryptographic keys to issue fraudulent TLS certificates or make malicious software appear to come from trusted publishers. The advisory stated that private keys linked to six Transport Layer Security (TLS) certificates and two code‑signing certificates could be recovered almost instantly because they were generated with insufficient cryptographic randomness. An attacker possessing these keys could issue fraudulent certificates for domains they do not control, or sign malware with a trusted publisher’s name. The Ministry of Electronics and Information Technology has set up a special team to investigate the incident involving digital‑certificate provider eMudhra.

eMudhra confirmed that its infrastructure had not been compromised and no data had been breached. The company clarified that the incident had no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses, which run on infrastructure completely separate from the global TLS business. It added that the DSC and eSign services in India were operating normally. The affected global TLS business accounts for around 1 % of eMudhra’s revenue, but the company warned that reputational risks could arise, though they could not be quantified. eMudhra is working directly with potentially affected customers to provide replacement certificates and avoid disruption to critical services.

Mozilla responded by blocking the six affected TLS intermediate certificates through its OneCRL certificate block list and issued updates for Firefox and its extended support release versions. Google also blocked the affected public keys in Chrome and announced plans to remove the emSign ECC Root CA – G3 certificate from its Chrome Root Store on 27 October. The removal could cause otherwise legitimate certificates linked to the root to become untrusted, potentially disrupting some websites and services, CERT‑In said. Google reported that no TLS certificates linked to the six affected intermediates had appeared in Certificate Transparency logs before its blocking action.

Internet infrastructure company Cloudflare rolled out security fixes across its services after becoming aware of the incident at around 1700 GMT on 19 October. In a blog post it described the event as a serious security incident with implications across the Internet. Cloudflare stated that customers using Cloudflare Zero Trust with its Gateway service and an up‑to‑date client were automatically protected, but some users would need to update software or review their own certificate trust configurations, particularly on origin servers. The company also urged organisations to verify code‑signing certificate chains and avoid bypassing certificate‑validation warnings.

The eight intermediate certificate authorities used in eMudhra’s global TLS business were created under its elliptic‑curve cryptography (ECC) root during a key‑generation ceremony on 30 April 2025. A flaw in the ceremony caused a wrap‑and‑unwrap step to produce a second set of weak keys alongside the original strong keys, the company said. The weak keys were the ones published to browser root stores. An independent researcher discovered that the weak keys could be reverse‑engineered possibly with AI‑assisted techniques last weekend, and reported this to the major root programmes: Apple, Google, Microsoft and Mozilla.

The Ministry of Electronics and Information Technology stated that the impact on Indian websites and applications had been very limited and for a very short interval. CERT‑In advised organisations to update browsers and certificate trust stores, review services relying on the affected certificates, replace certificates where necessary and monitor for unauthorised certificate issuance. It also urged software vendors and administrators to verify code‑signing certificate chains and avoid bypassing certificate‑validation warnings. eMudhra is working with browser root programmes as its investigation continues, and it has established a special team to investigate the incident, according to the ministry’s posts on X.