eMudhra Apologises For Weak Crypto Keys, Announces Independent Security Review

eMudhra has apologised for weak cryptographic keys linked to eight certificate authorities and announced an independent expert review after a security lapse.

Written By : Ehtisham Qudrat | Updated at : 27 Oct 2026 12:57 PM (IST)

emudhra apologises weak crypto keys independent security review eMudhra Apologises For Weak Crypto Keys, Announces Independent Security Review

eMudhra's key system weakness was reported in October this year, but apparently remained in the system for months before that.

Source : ABPLIVE AI

Show Quick Read

Key points generated by AI, verified by newsroom

Indian firm eMudhra apologized for a serious security lapse.
Weak, guessable cryptographic keys affected eight digital certificate authorities.
Major tech companies blocked certificates; government launched investigation.
eMudhra commissioned review, exiting TLS certificate business.

Indian cybersecurity firm eMudhra has apologised for a security lapse involving eight digital certificate authorities after researchers found that their private cryptographic keys were dangerously easy to guess. The company has announced an independent expert review to examine the incident and its internal security procedures. In a public statement, eMudhra acknowledged responsibility for the flaw, saying, “The flaw was ours. A script error resulted in issuing CA’s with weak keys.” The company apologised to its customers, industry partners and the wider web security community, which relies on digital certificates to verify the identity of websites.

The affected keys were associated with eight intermediate certificate authorities operated under its emSign G3 infrastructure. Such certificates help establish trust between websites and browsers, allowing users to verify that they are connecting to legitimate online services.

What Went Wrong With eMudhra's Security Keys?

The eight cryptographic keys were supposed to be generated using the P-384 elliptic-curve cryptography standard, which relies on highly complex numbers that are practically impossible to guess through brute force.

However, the keys were found to have extremely small values: 4, 56, 66, 115, 155, 156, 230 and 237. This made them recoverable, potentially allowing an attacker to create fraudulent digital certificates that could appear trustworthy to browsers.

The weakness remained in eMudhra's systems from April 2025 until it was reported by a security researcher in October this year.

Digital certificates act as electronic identity documents for websites. If an attacker obtains the private key of a certificate authority, they could potentially issue fake certificates and impersonate legitimate websites, creating a risk to secure online communications.

Company Says Affected Keys Not Misused

Responding to the issue, eMudhra said, “The affected intermediate CAs were revoked within 14 hours of our confirming the issue. The company also added, “ Based on our investigation to date, the affected intermediates had not issued publicly trusted end-entity certificates.”

According to the company, there had been no compromise of its infrastructure or customer data. However, the weakness raised concerns about the security checks and procedures used during the key-generation process.

The company said, “We will publish a full root-cause analysis through the CCADB process.” The report is expected to explain how the error occurred, why internal controls failed to detect it and what corrective measures would be introduced.

Independent Review And Exit From TLS Certificate Business

As part of its response, eMudhra said, "We are also commissioning an independent expert to review the incident and the procedures and controls followed by us.” The company has also announced its exit from the Transport Layer Security (TLS) certificate business. It said, “eMudhra will reach out to affected customers to replace any certificate free of cost from partners through the transition.”

Following the disclosure, major technology companies, including Google, Apple, Microsoft, and Mozilla, took steps to block affected certificates. Cloudflare and other providers also introduced security measures to address the issue.

Meanwhile, the Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident.

Although the affected keys created a potential risk of website impersonation, available findings have not established that they were exploited to steal user data. The independent review is expected to provide further clarity on the cause of the lapse and the measures being taken to prevent similar incidents.

Frequently Asked Questions

What was the security issue at eMudhra?

eMudhra had a security lapse where private cryptographic keys for eight digital certificate authorities were dangerously easy to guess. A script error caused keys to be generated with extremely small values instead of complex ones.

What was the potential impact of these weak keys?

Weak keys could potentially allow an attacker to create fraudulent digital certificates and impersonate legitimate websites. However, eMudhra stated no publicly trusted certificates were issued by the affected keys.

How is eMudhra responding to this incident?

eMudhra apologized, revoked affected certificates, and commissioned an independent expert review. They also announced their exit from the TLS certificate business and will offer free replacements.

Were any users or websites compromised due to this lapse?

eMudhra stated there was no compromise of its infrastructure or customer data. While there was a potential risk of website impersonation, no exploitation to steal user data has been established.

About the author Ehtisham Qudrat

Ehtisham Qudrat is a digital content writer at ABP Live English, covering technology news and creating affiliate content. He has a background in journalism and mass communication, with an interest in digital media and emerging technology.