eMudhra Ltd. is a Bengaluru-headquartered
digital trust and cybersecurity company operating as India’s largest licensed
Certifying Authority (CA). Its core business revolves around digital trust
services, identity verification, and paperless transformation solutions using
Public Key Infrastructure (PKI) technology. In short, it serves as a digital
“trust backbone”, ensuring machine-to-machine communications are authenticated,
secure and legally recognized.
On October 19, 2026, an
independent researcher found that eight of eMudhra’s private keys—which are
supposed to be unguessable, mathematically random numbers used to verify the
legitimacy of secure websites—associated with eight of its intermediate
certificates were mathematically flawed. A bug in eMudhra’s certificate
generation script back in April 2025 had accidentally tied the private keys to
their publicly distributed certificates, and these keys were so hilariously weak—the
private keys of certificates were generated with zero mathematical strength; one
was as small as the single-digit “4”—that they could be cracked and recovered
in no time using basic math, that too, without needing to hack eMudhra’s
servers.
The damage that the flawed keys caused
could have been catastrophic to the foundation of internet security. For, with
the so weakly generated keys, malicious actors or State-sponsored hackers could
have self-issued perfectly valid, authentic-looking digital Secure Sockets
Layer (SSL)/Transport Layer Security (TLS) certificates for any website on the
internet, such as Google.com, Microsoft.com or major banking portals. As the
forged certificates are signed by a trusted authority—eMudhra—web browsers would
be deceived into trusting them, enabling spoofing and man-in-the-middle
attacks. Attackers could have seamlessly captured, read and altered supposedly
secure data in real time, including corporate login credentials and passwords,
credit card details and bank account numbers, private emails, and medical
records.
Fortunately, this vulnerability
remained unnoticed in the wild for almost 17 months—no end-entity certificates
had been issued through them—until it was discovered by a conscientious
researcher who ran an open-source auditing tool designed to check public
certificate databases for low-randomness mathematical errors. Immediately on
noticing the flaw, he sent a note to major browser vendors such as Google,
Apple, Microsoft, and Mozilla. These bodies responded immediately with coordinated
defense measures to neutralize the threat, bypassing the standard revocation
timelines and pushing the emergency software patches directly to billions of
devices worldwide. These updates hardcoded a permanent blocklist that
completely untrusted eMudhra’s compromised roots. Reports also indicate that
Google’s Chrome Root Program is actively collaborating with international
root-store operators and software maintainers to audit whether eMudhra’s
remaining domestic CA certificates can safely remain trusted. That said, it
must also be admitted that non-browser TLS clients such as millions of older Internet-of-Things
(IoT) devices, smart appliances, and legacy embedded systems face most of the
remaining risk.
In a press interview, the
cofounder of eMudhra said that the keys came out of a formal key generation
exercise when an error in an additional wrap-unwrap step for keys intended for
international operations produced weak keys alongside the intended strong ones.
In the process, the company’s market valuation suffered a catastrophic crash (lost
34% of market cap in two successive sessions) on the stock market. It even
forced the firm to exit from the global SLL/TLS certificate business entirely. Concurrently,
the Ministry of Electronics and Information Technology (MeitY) has taken
cognisance of the incident and appointed a committee to investigate the human
error and audit the oversight failures that allowed the script error to happen
unnoticed. It thus became a textbook example of what happens when the core rule
of cryptography—keeping a private key mathematically complex and completely
secret—is entirely broken.
When asked
if the firm can assure that the Indian users of digital-signature services used
for GST filings, income tax returns and other government services are not
affected by the incident, the cofounder of the company said: “The Indian DAC
business runs on a completely isolated and separate infrastructure” and “there
has been no incident similar to this”. He further said: “We plan to introduce
more stringent oversight of key-generation ceremonies, additional maker-checker
controls and artificial intelligence tools to automatically verify key
strength”.
Over and
above all this, eMudhra episode—basic cryptographic hygiene overridden by a
code script-flaw—posits an important question: Will it have any impact on
India’s digital technology and cybersecurity reputation? Historically speaking,
similar failures—DigiNotar of Netherlands/ WoSign of China—permanently damaged
global trust in those nations’ security systems. All along, we have positioned
ourselves as a global leader in digital public infrastructure through platforms
like Aadhaar, UPI, and eSign. But with the eMudhra episode, that image is likely
to be eroded: the country’s credibility in engineering high-security, sovereign
PKI will be called into question.
