eMudhra Apologises For Weak Crypto Keys, Announces Independent Security Review

Indian cybersecurity firm eMudhra has apologised for a security lapse involving eight digital certificate authorities after researchers found that their private cryptographic keys were dangerously easy to guess. The company has announced an independent expert review to examine the incident and its internal security procedures. In a public statement, eMudhra acknowledged responsibility for the flaw, saying, “The flaw was ours. A script error resulted in issuing CA’s with weak keys.” The company apologised to its customers, industry partners and the wider web security community, which relies on digital certificates to verify the identity of websites.

The affected keys were associated with eight intermediate certificate authorities operated under its emSign G3 infrastructure. Such certificates help establish trust between websites and browsers, allowing users to verify that they are connecting to legitimate online services.

READ MORE: Microsoft Rolls Out Voluntary Exit Scheme For Employees In India, US, UK And Canada

What Went Wrong With eMudhra's Security Keys?

The eight cryptographic keys were supposed to be generated using the P-384 elliptic-curve cryptography standard, which relies on highly complex numbers that are practically impossible to guess through brute force.

However, the keys were found to have extremely small values: 4, 56, 66, 115, 155, 156, 230 and 237. This made them recoverable, potentially allowing an attacker to create fraudulent digital certificates that could appear trustworthy to browsers.

The weakness remained in eMudhra's systems from April 2025 until it was reported by a security researcher in October this year.

Digital certificates act as electronic identity documents for websites. If an attacker obtains the private key of a certificate authority, they could potentially issue fake certificates and impersonate legitimate websites, creating a risk to secure online communications.

Company Says Affected Keys Not Misused

Responding to the issue, eMudhra said, “The affected intermediate CAs were revoked within 14 hours of our confirming the issue. The company also added, “ Based on our investigation to date, the affected intermediates had not issued publicly trusted end-entity certificates.”

According to the company, there had been no compromise of its infrastructure or customer data. However, the weakness raised concerns about the security checks and procedures used during the key-generation process.

The company said, “We will publish a full root-cause analysis through the CCADB process.” The report is expected to explain how the error occurred, why internal controls failed to detect it and what corrective measures would be introduced.

READ MORE: Apple To Replace iPhone Duo Units With Faulty Screens; iFixit Points To Possible Hinge Flaw

Independent Review And Exit From TLS Certificate Business

As part of its response, eMudhra said, "We are also commissioning an independent expert to review the incident and the procedures and controls followed by us.” The company has also announced its exit from the Transport Layer Security (TLS) certificate business. It said, “eMudhra will reach out to affected customers to replace any certificate free of cost from partners through the transition.”

Following the disclosure, major technology companies, including Google, Apple, Microsoft, and Mozilla, took steps to block affected certificates. Cloudflare and other providers also introduced security measures to address the issue.

Meanwhile, the Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident.

Although the affected keys created a potential risk of website impersonation, available findings have not established that they were exploited to steal user data. The independent review is expected to provide further clarity on the cause of the lapse and the measures being taken to prevent similar incidents.