eMudhra Exits SSL/TLS After Weak Keys 4, 56, 115 Found in 2025 Ceremony

The certificates were generated during an April 2025 key ceremony whose procedural flaw survived two audits and remained undetected for 18 months. Weak keys allowed any party to forge HTTPS certificates for arbitrary domains, enabling traffic interception or modification. Browser vendors including Chrome, Firefox, and Apple immediately blocked the intermediates while Cloudflare confirmed the same keys were trusted in its own infrastructure.

Evidence shows the root cause was procedural rather than a targeted compromise. CERT-In alerts and eMudhra statements both confirm no observed misuse, yet the keys' trivial values (4, 56, 115) demonstrate that ceremony controls failed at the entropy step. This incident aligns with prior CA failures where manual processes bypassed randomness requirements.

The withdrawal decision, framed by eMudhra as a 1% revenue line burdened by compliance, exposes deeper supply-chain exposure. Trust stores embedded in IoT firmware, legacy containers, and vendor appliances require separate updates that most organizations cannot inventory. Brian Fox of Sonatype correctly identifies this as a multi-year remediation problem beyond browser revocation lists.

Google is now reviewing eMudhra's remaining roots for continued inclusion. Migration of subscribers and full root-cause disclosure are required before any future re-entry into browser programs.