Security teams worldwide are scrambling after the discovery of eight TLS certificates issued by India-based certificate authority eMudhra Limited. The certificates' private keys were so weak—ranging from 3 to 8 bits of entropy instead of the expected 384—that anyone possessing them could forge trusted credentials for any website or app. An informal advisory signed with one of the compromised keys confirmed the find, prompting browser makers and major software vendors to block all eight intermediate certificates by late morning Tuesday.
The immediate response has been swift for browsers, but the broader internet remains exposed. Cryptography engineer Filippo Valsorda, a maintainer for the Go programming language, told Ars Technica the cleanup will be "bigger than Heartbleed," with a "very, very long tail" of vulnerable systems. Linux distributions are still rolling out updates, and embedded devices, IoT hardware, Docker containers, and unmaintained CLI tools may carry their own copies of the affected roots for years.
For businesses, the incident underscores how fragile the trust infrastructure has become. Replacing the compromised certificates requires coordinated action across countless vendors and system administrators, a process that is time-consuming and expensive. The most immediate risk may be for VPN users in countries where governments can intercept traffic, though any active man-in-the-middle attacker on a local network—such as a coffee shop or university—could also exploit the weakness. End users have little recourse beyond avoiding non-browser TLS communications until updates are confirmed.
No malicious use of the compromised keys has been observed in certificate transparency logs, and the attack requires an active adversary-in-the-middle position. Still, experts note that the incident exposes a fundamental flaw in the TLS ecosystem: it is only as strong as its weakest link, and eMudhra's generation process failed catastrophically. Apps like Signal and WhatsApp, which do not rely on TLS for confidentiality, are not affected, but the broader cleanup is just beginning.