Google Removes eMudhra Root Certificate After Weak Key Vulnerability

Google removed the emSign ECC Root CA – G3 certificate on Oct. 27 after a researcher exposed weak private keys in eMudhra’s global hierarchy, prompting browser blocks and a pullback from the TLS market.

Oct. 17, 2024 – Vulnerability disclosed

A security researcher reported that eight certificate‑authority private keys under eMudhra could be derived from weak parameters. The keys, created at a single key ceremony on Apr. 30, 2025, were far shorter than the required 116‑digit length, falling below 256 bits.

Oct. 17–19, 2024 – Browser response

Google acted within 1 hour and 40 minutes, adding the compromised certificates to its Chrome CRLSet blocklist on Oct. 17. Mozilla followed hours later, updating Firefox and its certificate store. Apple released Safari patches on Oct. 19 to block the affected certificates.

Oct. 20–22, 2024 – eMudhra’s remediation

eMudhra revoked the vulnerable certificates and issued emergency patches. The company said a scripting error during the key ceremony generated a duplicate, weak key set that was mistakenly used because of similar labeling.

Oct. 23, 2024 – Board decision

Within five days of the report, eMudhra’s board voted to exit the global TLS certificate business, a segment that accounted for about 1% of its revenue.

Oct. 24–28, 2024 – Indian regulatory action

The Ministry of Electronics and Information Technology formed a special investigation team. CERT‑In issued an advisory four days after the initial report. An auditor’s report on the key ceremony is expected in two to three weeks.

Current status

All major browsers have blocked the compromised certificates. eMudhra is no longer issuing global TLS certificates, while Indian authorities continue to examine possible rule violations and penalties.

Why it matters: The incident highlights weaknesses in certificate‑authority key management that can expose web users to man‑in‑the‑middle attacks. Prompt browser action limited exposure, but the slower regulatory response in India raises concerns about oversight of critical digital‑security infrastructure in the region.