eMudhra Certificates Are Compromised

The incident concerns fraudulent TLS certificates issued through eMudhra, an India-based certificate authority trusted by browsers. Such certificates can make an attacker-controlled server appear legitimate for a protected domain, enabling impersonation or interception of encrypted connections. The problem was not a weakness in TLS itself: it was a breach of trust in the certificate-issuing chain, where a trusted authority or one of its subordinate authorities could authorize identities without the domain owners’ consent.

The reported certificates covered well-known services, including Google domains, and were issued without authorization from those organizations. That meant browsers could accept a forged identity as valid unless the certificates were explicitly rejected. The response involved revoking the affected certificates and having browser vendors block them, while eMudhra’s certificate practices and security were scrutinized. The episode shows why the security of the web depends on certificate authorities protecting their signing keys and validating requests carefully: a single compromised issuer can undermine encrypted connections across many sites, even when the sites themselves have not been hacked.