Why certificate strength matters for every site owner
When someone visits your website over HTTPS, their browser checks a chain of trust. At the heart of that chain are TLS certificates — small digital files that prove your site is who it says it is. Those certificates rely on cryptographic keys, and if a key is too weak, an attacker can potentially break it and impersonate your site, or intercept traffic.
That is exactly the problem discovered with eight intermediate certificates issued by eMudhra, an Indian certificate authority (CA) — a trusted organisation that issues these certificates. The keys protecting those certificates were found to be significantly weaker than modern standards require, meaning they could, in theory, be cracked.
What actually happened
Intermediate certificates sit in the middle of the chain between a root CA (the ultimate authority browsers trust) and the certificates installed on individual websites. If an intermediate certificate is compromised, every site certificate it signed is potentially at risk too.
Cloudflare, which handles traffic for millions of websites, spotted the problem and moved quickly. It has deployed mitigations on its network and released updates to client software that rely on these certificates. The certificates in question are being treated as untrusted while the situation is resolved.
Does this affect your website?
Most site owners will not be directly affected. If your TLS certificate was issued by a mainstream CA — Let’s Encrypt, DigiCert, Sectigo, or similar — you are not in the affected chain. However, there are two cases where you should pay attention:
1. Your certificate was issued by eMudhra or a CA that chains up to one of the eight affected intermediates. Log in to your hosting control panel or check your certificate details. Look at the “issued by” field. If eMudhra appears anywhere in the chain, contact your host or CA immediately and request a reissue.
2. Your application or server validates certificates from third parties. If you run a server that accepts inbound connections from clients using these certificates — for example, a payment integration or API — check whether any partner uses eMudhra certificates and plan for a transition.
The bigger picture
This incident is a useful reminder that the certificate ecosystem depends on every link in the chain being strong. Certificate authorities are periodically audited, and when weak keys are found, the industry moves to revoke and replace them fast. For most site owners, the practical lesson is simple: use a well-known CA, enable automatic certificate renewal (most hosts offer this for free via Let’s Encrypt), and check your certificate chain at least once a year using a free tool like SSL Labs’ server test. Weak foundations quietly undermine security long before anyone notices.
