On Tuesday, internet defenders scrambled after researchers found eight eMudhra intermediate TLS certificates whose private keys were so weak that an attacker could derive them in milliseconds and mint trusted certificates for virtually any website or mail server.¹ The keys, meant to have the vast randomness of P-384 cryptography, had values ranging from just 4 to 237 — an error security engineers struggled to comprehend.¹

Browsers and several major software platforms blocked the intermediates by late morning, and there were no reports that the compromised keys had been abused. But the rapid browser response did not settle the wider problem. Filippo Valsorda, a Go cryptography maintainer, called it “a massive cleanup job, bigger than Heartbleed,” warning of a long tail across IoT devices, Docker containers, aging Linux machines and unmaintained tools carrying their own root stores.¹

Two days later, eMudhra said it would withdraw from global SSL/TLS. Its chairman, V. Srinivasan, pointed to rising compliance costs, free certificate providers and TLS accounting for only 1 percent of company revenue. The company also argued that social-media attention had brought scrutiny “out of proportion to SSL/TLS’s place in our business.”²

Its technical account described a failure during an April 30, 2025 key-generation ceremony. Strong ECC keys were initially created, eMudhra said, but an approved wrap/unwrap test produced a second, weak set; similar labels then led staff to use the flawed keys for certificate-signing requests and a Sectigo cross-signing process.²

The company acknowledged “human errors in multiple steps” and said it would recheck every key ceremony. Browser blocks have cut off much of the immediate threat, but embedded and poorly maintained systems may take far longer to catch up — and some may never be updated.²