Eight intermediate TLS certificates issued by eMudhra contained private keys sized at just 3 to 8 bits—cryptographically useless—prompting browser makers and major applications to block them immediately.
Intermediate TLS certificates sit in the middle of the chain of trust, allowing a Certificate Authority to delegate signing authority from its heavily guarded root certificate to client certificates used by websites and apps. The problem: eMudhra's intermediates could be cracked trivially. Modern standards require minimum key sizes of 2048 bits for RSA or 256 bits for elliptic curve cryptography.
With a compromised intermediate private key, an attacker can forge certificates for any domain—effectively impersonating legitimate services and intercepting encrypted communications. Browser blocks prevent the fraudulent end-entity certificates from establishing trusted connections, containing the damage.
For eMudhra, the incident is existential. A CA's entire business model depends on one asset: reputation. Enterprise clients license certificates because they trust the issuer to vet domain ownership and protect key material. A failure of that magnitude doesn't just lose customers—it forces competitors to distance themselves publicly and triggers audits across the entire CA ecosystem.
The competitive moat that CAs rely on is razor-thin: zero tolerance for operational errors. One lapse in cryptographic hygiene or key management, and the market recalibrates risk across the entire provider. Other CAs will cite this incident to justify premium pricing or tighter vetting standards. eMudhra faces expensive remediation and a lengthy rebuild of market confidence.
