Compromised TLS certificates from India-based CA eMudhra pose global risk

Security teams worldwide are responding to the discovery of eight compromised TLS intermediate certificates issued by India-based certificate authority eMudhra Limited. The private keys associated with these certificates contain between 3 and 237 bits of entropy, far below the roughly 384 bits expected for a NIST P-384 elliptic curve key. Experts described the weakness as "extremely in the 'this should not be possible' category," with Filippo Valsorda, a cryptography engineer and maintainer for the Go programming language, calling the situation "bonkers."

Browser vendors and major applications have already blocked the eight intermediate certificates, but the broader remediation effort is still underway. Linux distributions, embedded systems, IoT devices, Docker containers, and even some programming language ecosystems that bundle their own root stores remain vulnerable. Valsorda warned that the cleanup will be "a massive cleanup job, bigger than Heartbleed," referencing the 2014 vulnerability in OpenSSL that required years of coordinated patching, reissuance of millions of keys, and updates across countless devices.

As of publication, most browsers had blocked the certificates, with Microsoft’s Edge reportedly still connecting to 12 vulnerable hosts. Signal, WhatsApp, and WireGuard are unaffected because they do not rely on TLS for confidentiality. An informal advisory site, emudhra.we-have-a-problem.com, and a dedicated page list apps known to be patched so far.

The incident underscores the fragility of the web’s trust model, where a single compromised certificate authority can enable the unauthorized issuance of trusted credentials for any domain. While certificate transparency logs have helped detect unauthorized issuance, the proactive monitoring required is resource-intensive and only reactive once abuse occurs. The compromised keys could allow an adversary to perform man-in-the-middle attacks, though such exploitation requires an active network position or significant resources.