Google Removes eMudhra Root Certificate After Weak-Key Flaw

On October 27, Google removed eMudhra's emSign ECC Root CA – G3 from the Chrome Root Store. Websites still relying on it now show Chrome users a full-page security warning.

The move follows a mid-October disclosure involving Bengaluru-based eMudhra, India's largest licensed certifying authority. A researcher showed that the private keys of eight certificate authorities in its global hierarchy were so weak that anyone could work them out.

A flawed key ceremony

According to the company, all eight keys were generated at one key ceremony on April 30, 2025. eMudhra says a flaw in its script produced a second, weak set of keys, which were used by mistake because their labels looked similar. Each key should have been about 116 digits long; all eight were below 256. The error went unnoticed for about 18 months and two audit cycles. Cofounder Kaushik Srinivasan called it "a one-off, a bad day". An auditor's report is due in two to three weeks.

After the researcher's October 17 report, browser makers acted within hours. Chrome blocked six certificates through its CRLSet blocklist, and Mozilla blocked them in Firefox. Apple followed on October 19 with Safari patches, and Microsoft on October 20 for Edge. Mozilla removed the G3 root from its trusted list on October 20. Chrome said no certificate from the six intermediates had appeared in public Certificate Transparency logs before the block, so none could have been used against it. Google is also examining whether eMudhra's remaining roots should stay trusted.

Exit and accountability

On October 22, eMudhra announced it would wind up its SSL/TLS business, withdrawing the G3 and G1 roots. The company says the business accounts for 1% of revenue. Its customers included a US university federation and several government departments and companies outside the US.

In India, the response has been slower. The IT ministry has formed a special team, and CERT-In issued an advisory four days after the first report. The open question is who holds a certificate authority accountable in India, which rules may have been broken and what penalties could follow. eMudhra, listed on BSE and NSE since 2022, also issues digital signature certificates for income tax, GST, customs and company law filings under the Controller of Certifying Authorities.