A cybersecurity vulnerability involving Indian digital trust provider eMudhra has raised concerns after researchers found that the private keys associated with eight of its digital certificates were weak and potentially vulnerable to exploitation.

Security specialists warn that attackers could use the flaw to generate fraudulent certificates and pose as trusted websites. Such activity could expose users and online services to security risks by undermining the trust mechanisms used to verify website identities.

The affected certificates were generated in April 2025. According to researchers, a problem during the key-generation process produced weak cryptographic keys instead of the strong, randomly generated keys required to protect digital communications.

Some of the compromised keys were reportedly so simple that researchers could recover them in less than a second. These keys were linked to six website security certificates and two code-signing certificates.

Digital certificates help browsers verify that a website is genuine. If attackers gain access to the corresponding private keys, they may be able to create fraudulent certificates and make malicious websites appear trustworthy.

Major technology companies have moved to block the affected certificates. Google updated protections for Chrome and Android, while Apple and Mozilla also took steps to prevent their systems from trusting the compromised certificates.

However, experts say the problem may take longer to resolve across software, servers and connected devices that do not automatically check whether certificates have been revoked.

Google has also announced plans to remove a related eMudhra root certificate from Chrome’s trust store, a move that could affect some legitimate websites if they do not migrate to replacement certificates.

eMudhra said the issue affects eight intermediate certificates used in its global website-security business. The company stated that its Indian digital signature and eSign services remain unaffected and that it has found no evidence of a customer data breach linked to the incident. It is working to replace the affected certificates.

The incident highlights how a flaw in a single part of the internet’s trust infrastructure can create risks across multiple systems. The focus now is on replacing compromised certificates, updating software and ensuring that affected systems no longer trust the vulnerable keys.

Feeling overwhelmed by the markets? Let Tradz by EquityPandit be your guide. Our user-friendly app simplifies complex data and provides actionable trading signals. Download the app today and trade with confidence!