New Delhi: In a development that has triggered a response from global tech companies, eight eMudhra intermediate certificate authorities turned out to have weak private keys that researchers could recover almost instantly from their public keys. eMudhra has said that the flaw arose during a key-generation process in April 2025.Those keys could potentially allow attackers to create trusted certificates for websites they do not own, impersonate legitimate sites and intercept or modify encrypted communications. These certificates belonged to eMudhra’s international website-security business, trusted by major browsers.An investigation into the root cause is ongoing. MeitY issued a brief statement on the issue.A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain.Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter.— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026Google and Mozilla have announced that they have blocked the affected certificates. Google said no TLS certificates issued through the six affected intermediates had appeared in Certificate Transparency logs before it blocked them.TLS stands for Transport Layer Security. It is the protocol, such as HTTPS, that secures connections between browsers and websites.eMudhra has also said the affected intermediates had not issued end-user certificates. CERT-In issued a detailed response to the development as well. It said the incident does not affect eMudhra’s domestic digital-signature certificate and eSign services regulated by MeitY.Google plans to take further action against the compromised intermediates, removing the root certificates from Chrome’s trust store on October 27, 2026. Some (legitimate) websites using certificates that link to that root could stop working in Chrome, unless they migrate to another trusted certificate hierarchy.Mozilla said on its online bug-tracking system Bugzilla on October 20 that it had “completed the process of blocking the affected certificates in Firefox using OneCRL, Mozilla’s centralised list of revoked certificates which we introduced in 2015”. It said the process did not require users to update or even restart Firefox.