eMudhra, one of the few Indian root certificate authorities trusted by major browsers, said on 22 October that it is voluntarily withdrawing from the global SSL/TLS certificate business, days after eight of its intermediate private keys were found to be weak and Chrome, Firefox and Apple blocked the affected certificates. The withdrawal turns a certificate-removal exercise into the collapse of a browser-trusted CA brand: the company told users it is exiting the business rather than reissuing under the same root. eMudhra said the certificates were created during a ceremony in April 2025 and that the fault was a flaw in one step of the ceremony procedure — a defect that went undetected for 18 months and survived two independent audits before researcher Scott Helme reverse-engineered the weak key material. Because those certificates were trusted by browsers, operating systems and major service providers, anyone able to intercept a connection could have minted a certificate for a domain they do not control and impersonated it. The remediation burden now runs well beyond browsers, into Go, curl, Python and Electron trust stores.

• Source article