Mozilla, Google, Apple block compromised eMudhra CA certificates

eMudhra, a trusted Certificate Authority, generated eight intermediate certificates using cryptographically weak private keys that could be instantly recovered by attackers. This failure in cryptographic key generation allowed for the potential forging of trusted certificates, meaning attackers could impersonate any website secured by those certificates and intercept encrypted communications. The incident highlights a critical trust dependency in the PKI (Public Key Infrastructure) supply chain — when a CA fails to meet cryptographic standards, every website relying on its certificates becomes a potential attack vector. Major browsers and operating systems were forced into reactive emergency blocklisting, underscoring the systemic risk that poor CA security hygiene poses to the entire internet ecosystem.