India, Oct. 27 -- Eight recoverable certificate authority (CA) keys went undetected for nearly 18 months despite public disclosure, an earlier security warning, audits, and browser reviews. The incident has forced eMudhra out of the global TLS certificate business and raised questions about who verifies the keys browsers trust.

An independent security researcher has questioned why Google's Chrome Root Program failed to detect eight dangerously weak certificate authority (CA) keys belonging to India's eMudhra, despite the availability of Google's own cryptographic testing software since 2022.

Jacob Durham raised the issue in Mozilla's public Bugzilla tracker after another researcher discovered the defective keys on October 17, 2026, usin...