eMudhra, the Bengaluru-based digital certificate company, said on 22 October that it will withdraw from the global SSL/TLS certificate business, the part of its operations that issues the certificates websites use to prove their identity to browsers. The decision follows a discovery, reported on 17 October, that the private keys behind eight of its intermediate certificate authorities were so weak they could be worked out almost instantly. Google and Mozilla blocked the affected certificates within hours, and both have said they will stop trusting one of eMudhra’s root certificates, emSign ECC Root CA – G3.

eMudhra says the affected authorities were revoked within 14 hours, that none of the eight keys were used to issue certificates to websites, and that its systems were not breached. Google has said it found no website certificates from the affected intermediates in public Certificate Transparency logs before Chrome blocked them. The company puts the business it is leaving at about 1% of its revenue.

Why it matters

The padlock in your browser rests on a chain of trust. Anyone holding a certificate authority’s private key could, in theory, create a convincing certificate for a site they do not own and use it to intercept traffic. That is why browser makers acted quickly, even without evidence of misuse.

For most people in India, the direct impact looks small. The Ministry of Electronics and Information Technology (MeitY) described the effect on Indian websites and apps as “very limited” and short-lived. It also said eMudhra’s Digital Signature Certificates and eSign services, which are regulated separately by the Controller of Certifying Authorities, are not affected. Those are the tools many people use to sign tax filings and official documents. MeitY has set up a special team to investigate, and CERT-In has issued an advisory. By Google’s count, most of the roughly 30,800 certificates linked to the distrusted root were issued through InCommon, a service used largely by universities in the United States.

What you can do

  • Keep your browser and phone updated so they carry the latest list of trusted certificates.
  • Do not click past a browser warning about an invalid or untrusted certificate, especially on login or payment pages.
  • If you run a website with an eMudhra-issued TLS certificate, replace it with one from another trusted provider now. Chrome’s removal of the ECC root is expected around 27 October. eMudhra says it will contact customers and replace affected certificates free of cost through partners.
  • If you use an eMudhra digital signature or eSign for filings, nothing has changed based on what MeitY and the company have said so far.

Related on Elsepost

Sources