eMudhra certificate check

Does this website use a compromised eMudhra certificate?

Enter any website address. To see what an affected site looks like, try .

What happened

The padlock is only as trustworthy as the authority behind it

Your browser shows a padlock because a certificate authority vouches for the website. On 17 October, a researcher showed that 8 signing keys of eMudhra, an Indian certificate authority, were so weak they could be calculated.

Whoever has those keys can make a fake site, like a fake exchange or wallet page, look fully legitimate, padlock included.

The good news: Chrome and Firefox blocked the keys within hours, Apple and Microsoft within three days, and no misuse has been seen.

At risk

Anything that hasn't updated: old phones and laptops, some apps, TVs and routers.
The attacker would also need to sit on your network, for example on public Wi-Fi.

Not at risk

Up-to-date browsers and systems.
Signal, WhatsApp and WireGuard, which don't rely on these certificates.

What to do today

Update your devices, then open the browser test in each browser you use. The check above looks at a website; the browser test looks at your browser.

Rule to remember

Never click "continue anyway" on a certificate warning, especially on public Wi-Fi.