Mozilla and Google are removing trust in emSign ECC Root CA – G3, a root certificate operated by the Indian company eMudhra, after eight certificate authorities created under it were found to have secret keys that anyone could work out. India’s Ministry of Electronics and Information Technology (MeitY) has set up a special team to investigate.
eMudhra, based in Bengaluru and listed on India’s stock exchanges, provides digital identity, certificate management and authentication products to banks, enterprises and governments in more than 35 countries. In India, it issues digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities, that people and businesses use to sign documents electronically. Its certificates for websites and software, which it calls its global TLS business, are issued under the emSign brand.
Web browsers rely on such certificates to confirm that a site is genuine before setting up an encrypted connection. A certificate authority signs each certificate with a secret private key, and browser and operating-system makers keep lists of root certificates that their software trusts automatically. Each root is used to create intermediate authorities, which in turn issue the certificates that websites install. “ECC” in the root’s name refers to the elliptic-curve cryptography its keys use. Anyone who holds an authority’s private key can create certificates that browsers would accept for any website.
According to Mozilla’s incident report, a researcher reported on Oct. 17 that the keys of eight eMudhra intermediate authorities had been compromised, and Mozilla recovered them independently in less than two hours. Each key was a number smaller than 256, when a key of this type is meant to be a random number more than 100 digits long.
Six of the eight were authorities for website certificates and two for code-signing certificates, which verify software publishers. eMudhra revoked all eight on Oct. 18. It told Mozilla that a flawed script at an April 2025 key generation ceremony produced a second, weaker set of keys, which staff used by mistake because the labels were similar, and that only one of the eight went into production, without issuing any customer certificates.
Because several people have since recovered the keys on their own, Mozilla is removing trust in the entire root, which protects devices and software that cannot check whether individual certificates have been revoked. Chrome is taking a similar path and expects the change to reach users in Chrome Root Store v43 on Oct. 27. Other certificates issued under the root will then also stop being trusted. eMudhra has stopped issuing under the root and estimates that about 30,000 certificates need to be replaced.
MeitY said the incident concerns eMudhra’s internationally audited website and software certificates, not its Indian digital signature and eSign services, which the ministry said “remain completely unaffected.” It described the impact on Indian websites and applications as “very limited and for a very short interval,” and said CERT-In, India’s computer emergency response team, had issued an advisory with mitigation measures. eMudhra said its infrastructure was not compromised and that the global TLS business accounts for around 1 percent of its revenue.
Sources: Mozilla, eMudhra, NDTV, Help Net Security
–
By the ID Tech Editorial Team
