India has formed a team to investigate a reported eMudhra certificate incident involving eight weak keys, as Google’s planned root removal will cause some legitimate certificates to stop working in Chrome unless replaced.
The Ministry of Electronics and Information Technology (MeitY) said Oct. 21 that a special team had been formed to investigate the reported incident. It described effects on Indian websites and applications as very limited and brief. The Indian Computer Emergency Response Team (CERT-In) said India’s regulated Digital Signature Certificate and eSign services were unaffected.
CERT-In said the eight private keys tied to intermediate certificate authorities in eMudhra’s international certificate business had values below 256. That made it possible to derive the keys from matching public keys almost immediately, the advisory said. The weakness arose during key generation, not from a defect in the P-384 algorithm, CERT-In said. It warned that someone holding an intermediate key could create fraudulent certificates while the related certificate chain remained trusted.
eMudhra linked the weak keys to a key-generation operation on April 30, 2025, that involved a wrap-and-unwrap step, while saying its review has not identified the precise cause. The company said seven of the eight intermediates were never used in production; the one deployed authority issued no certificates. It also said none of the eight issued end-entity certificates and that it was not aware of evidence anyone had recovered or exploited the keys before disclosure.
Google said it blocked the affected public keys in Chrome on Oct. 17. The company reported that Certificate Transparency (CT) logs had no record of TLS certificates issued under the six affected TLS intermediates before the block. Mozilla’s public bug report identifies the remaining two as code-signing certificates.
Google expects to remove the emSign ECC Root CA - G3 from Chrome’s root store on Oct. 27, 2026. It warned that some legitimate certificates chaining to the root will stop working in Chrome unless replaced. eMudhra said the change affects one customer ecosystem in the United States and replacement certificates are being issued. The company said its website-certificate business accounts for around 1% of revenue, without specifying a reporting period.
