Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS certificate business.
Why It Matters
The weak keys could have enabled forged certificates, website impersonation, intercepted traffic, or malicious software that appeared trusted. No malicious use or related data breach was confirmed. For leaders: certificate trust can fail far beyond browsers and remain embedded in older products. For defenders: update trust stores, runtimes, containers, and devices that may retain affected chains. The larger lesson is that certificate failures become software supply-chain problems.
What Defenders Should Do
Inventory embedded certificate stores and update every client, runtime, container, and device that may still trust the affected chains.