eMudhra Certificates Blocked: Cybersecurity Flaw, Causes and UPSC Notes

Understand why Google, Mozilla, Apple and Microsoft blocked eMudhra certificates, including weak key generation, PKI, TLS, digital signatures and cybersecurity implications for UPSC.

Table of Contents

Context

Major browser vendors, including Google, Mozilla, Apple and Microsoft, took steps to block digital certificates issued by Bengaluru-based eMudhra after a cryptographic flaw compromised their security.

About eMudhra Certificates

Nature: Digital certificates issued by eMudhra, including Transport Layer Security (TLS)/Secure Sockets Layer (SSL) and code-signing certificates.
Uses: Authenticate website identities, encrypt online communication and verify software publishers.
Company: eMudhra was founded in 2008 and is a Certifying Authority licensed by the Controller of Certifying Authorities (CCA) under the Information Technology Act, 2000.
Market Presence: The source reports that it holds nearly 38% of India’s digital signature certificate market.

How Digital Certificates Work

Public Key Infrastructure (PKI): A trusted Root Certificate Authority (CA) validates Intermediate CAs, which issue certificates to websites and software publishers.
Asymmetric Cryptography: Uses a mathematically linked public key and private key. The public key helps verify identity, while the private key is used to create digital signatures and must remain secret.
Browser Validation: Browsers verify a website’s certificate chain against trusted root certificates before establishing a secure HTTPS connection.

Why Were eMudhra Certificates Blocked?

Weak Key Generation: An error during a cryptographic key-generation exercise on 30 April 2025 resulted in weak private keys.
Affected Certificates: Eight intermediate certificates were affected: six for website authentication and two for code signing.
Security Risks: Predictable private keys could enable forged certificates, website impersonation, man-in-the-middle attacks and malicious software signing.
Browser Response: Google and Mozilla blocked vulnerable certificates through mechanisms such as CRLSets and OneCRL. Measures were also taken to distrust the parent emSign Root TLS CA – G3.