eMudhra certificates are the digital trust files issued by the Bengaluru-based certifying authority eMudhra, used to prove a website or signer is genuine. Security researchers say Apple’s trusted-root list still marks some eMudhra certificates as safe, weeks after Google and Mozilla began cutting ties with the Indian certificate authority over a mis-issuance incident. That gap matters because a trusted root certificate, if misused, can quietly impersonate secure websites on iPhones and Macs.
Key Takeaways
- eMudhra, an Indian certifying authority, is at the centre of a global root-trust dispute after an incident involving improperly issued test certificates.
- Chrome and Firefox moved to distrust the affected eMudhra roots; Apple’s public trust-store code has been slower to follow, according to researchers tracking the repositories.
- The issue is specific to eMudhra’s internationally-trusted TLS roots, not the domestic digital signature certificates Indians use for income tax filing or GST.
- Website owners and developers who rely on eMudhra-issued SSL certificates should check their certificate chains now, before browsers force the change.
What Exactly Happened With eMudhra’s Certificates?
To understand why Apple’s trust list is suddenly news, it helps to trace a certificate the way you’d trace a chip back through a fab. A root certificate starts life in a key-generation ceremony — audited, filmed, and notarised, because whoever holds that private key can vouch for the identity of any website on the internet. From that root, a certifying authority issues intermediate certificates, and those intermediates sign the day-to-day “leaf” certificates that browsers check when you load a site.
eMudhra’s trouble started when auditors and independent researchers flagged test or mis-issued certificates that didn’t follow the CA/Browser Forum’s baseline requirements — the industry rulebook every public certificate authority has to follow to stay trusted. Mis-issuance of even one certificate matters disproportionately in this business, because trust in a root is binary. Browsers don’t wait for a pattern; one confirmed violation is usually enough to open a distrust proceeding.
Why Did Chrome and Firefox Move Faster Than Apple?
Each major software maker runs its own root certificate program — Google’s Chrome Root Program, Mozilla’s NSS-based program for Firefox, Microsoft’s Trusted Root program, and Apple’s own list baked into iOS, iPadOS and macOS. They’re meant to move in rough sync, and most incident reports get filed centrally through the Common CA Database (CCADB), which all four companies use to track CA compliance issues.
In practice, each vendor still ships changes on its own release schedule. Mozilla and Google can push distrust decisions through relatively fast browser updates. Apple’s root list, by contrast, travels with full OS updates, and parts of the underlying code are mirrored in Apple’s public open-source repositories, which is where researchers say they spotted eMudhra certificates still marked trusted even after Chrome and Firefox had already flagged them for removal. It’s less a cover-up than a plumbing lag — but on a system that locks down trust by design, a lag is still a window.
| Root Program | Reported Status on eMudhra Roots | Typical Update Channel |
| Google Chrome Root Program | Distrust action initiated | Browser-level update |
| Mozilla (Firefox/NSS) | Distrust action initiated | Browser-level update |
| Microsoft Trusted Root Program | Under review | Windows Update |
| Apple (iOS/macOS trust store) | Reported as still trusting affected roots | Full OS software update |
How Does a Certificate Travel From Root to Your iPhone?
This is the part worth slowing down on, because it explains why the fix isn’t a quick patch. Think of it as four stations on a production line:
- Key ceremony: the root’s private key is generated in a secured facility and almost never touched again.
- Intermediate signing: the CA uses the root to sign intermediate certificates that do the actual day-to-day issuing.
- Leaf issuance: intermediates sign the certificate your browser actually sees when you visit a website.
- Trust store distribution: operating systems and browsers ship a curated list of which roots to accept at all, bundled into every OS and browser update.
Distrust has to happen at that last station, across every device already in the field. For Apple, that means hundreds of millions of iPhones, iPads and Macs need a system update before the change actually lands — which is exactly why researchers are watching the public commits to Apple’s trust-store code so closely.
Does This Affect Indian Users of eMudhra’s Digital Signatures?
Here’s the nuance that’s getting lost in some of the panic: eMudhra wears two hats. Internationally, it’s a WebTrust-audited CA whose TLS roots sit in global browser trust stores — the eMudhra certificates now under scrutiny. Domestically, it’s also one of India’s licensed Certifying Authorities under the Controller of Certifying Authorities (CCA), issuing Digital Signature Certificates (DSCs) that Indians use to file income tax returns, sign GST documents and authenticate on the MCA portal.
Those two trust chains are legally and technically separate. A browser distrusting eMudhra’s public TLS roots doesn’t automatically touch the DSC ecosystem regulated by India’s IT Act. Still, the episode is a reminder that India’s semiconductor and digital-infrastructure ambitions don’t stop at wafers and fabs — the trust plumbing underneath apps, banking and e-governance is just as much “critical infrastructure,” and it deserves the same scrutiny as any hardware supply chain.
What Should Website Owners and Developers Do Now?
- Check whether your site’s SSL/TLS certificate chains back to an eMudhra root using your hosting provider’s SSL checker or a tool like SSL Labs.
- If you issue certificates through eMudhra for public-facing websites, ask your certificate reseller for a migration path to an unaffected CA.
- Keep iOS, iPadOS and macOS updated — Apple’s trust-store corrections ship through regular software updates, not silent background patches.
- Don’t confuse this with your personal DSC used for tax or compliance filings; that’s a separate, India-regulated trust chain.
FAQ
What is eMudhra?
eMudhra is an Indian certifying authority, headquartered in Bengaluru, that issues digital certificates for website security (TLS/SSL) and for digital signatures used in Indian regulatory filings.
Why are eMudhra certificates being distrusted?
Reports point to a mis-issuance incident where certificates were issued outside the CA/Browser Forum’s baseline rules, prompting Chrome and Firefox to begin removing trust in the affected roots.
Does Apple still trust eMudhra certificates?
According to researchers tracking Apple’s public trust-store code, some eMudhra certificates remained marked as trusted after other browsers had already acted, though Apple typically rolls out such changes with its next full OS update.
Will this affect my income tax e-filing in India?
Not directly. Income tax and GST digital signatures from eMudhra fall under India’s domestic CCA licensing, separate from the global TLS trust stores currently in question.
How do I check if a website’s certificate is affected?
Use a free SSL checker tool to inspect the certificate chain of any site you manage, and look for an eMudhra root or intermediate in the chain.
The bigger lesson here isn’t really about one certifying authority — it’s about how unevenly “trust” gets revoked once it’s been granted. Apple will almost certainly align its trust store with Chrome and Firefox soon enough. Until then, the gap is a useful reminder that digital trust, like a chip supply chain, is only as strong as its slowest link.