Bengaluru-based technology firm eMudhra has disclosed a significant security lapse involving eight intermediate digital certificates, sparking global concerns over the integrity of web authentication. The company revealed that the private cryptographic keys associated with these certificates, generated on April 30, 2025, were compromised due to a technical flaw that produced weak keys alongside the intended secure ones.
While standard cryptographic keys typically feature 384-bit strength, the flawed process resulted in keys as small as four digits. This vulnerability was discovered over the weekend by an independent researcher using the alias 'Wayne,' who reverse-engineered the keys and demonstrated the risk by digitally signing a message on a test website. Major browser providers, including Google, Apple, Microsoft, and Mozilla, have since blocked the affected certificates to prevent potential exploitation.
Cybersecurity experts have warned that the incident could have had severe consequences. Karan Saini, a cybersecurity researcher, described the situation as potentially catastrophic, noting that the weak keys could have allowed malicious actors to intercept and decrypt encrypted web traffic. Suman Kar, CEO of Banbreach, added, "If you are running a Certificate Authority, then it does not get any more serious than this. The risk is the same for any device that has not been told to ignore these certificates from eMudhra."
eMudhra has clarified that its internal systems remain secure and that the incident does not impact its Indian Digital Signature Certificate (DSC) or eSign services, which operate on separate infrastructure. The Ministry of Electronics and Information Technology (MeitY) confirmed this separation, stating that the affected TLS business operates under a global trust framework subject to independent audits. The ministry has formed a special team to investigate the matter.
Despite these assurances, the fallout continues. Google has moved to remove eMudhra’s 'emSign ECC Root CA – G3' from the Chrome Root Store to protect users on devices that may not receive immediate updates. The Indian Computer Emergency Response Team (CERT-In) issued an advisory on Wednesday, October 21, 2026, warning that the compromised keys could facilitate man-in-the-middle attacks and the issuance of fraudulent certificates.
While eMudhra stated that the affected intermediate authorities had not issued end-entity certificates, industry observers remain critical of the oversight. Yash Kadakia, founder of Security Brigade, emphasized the broader implications, stating, "This is not just about eight compromised certificates. It’s about the global internet’s chain of trust." eMudhra is currently working with affected customers to provide replacement certificates and is cooperating with global root programs as the investigation proceeds.
