Indian certificate authority eMudhra announced it will stop issuing SSL/TLS certificates following a critical security flaw. Researchers discovered that eight intermediate certificates used private keys that could be reconstructed in under a second due to insufficient randomness. The vulnerability stemmed from an error in a key generation ceremony held in April 2025, which resulted in weak keys being published to browser trust lists. Major browser vendors including Chrome, Firefox, and Apple quickly blocked the affected certificates, while Mozilla removed the company's root certificate from its trusted list. The company stated that its other digital services continue to operate normally, but its stock price dropped 40 percent following the disclosure.
Read the full story at cyberscoop.com.
Photo: kieutruongphoto / Pixabay
