eMudhra Apologises for Weak Crypto Keys, Announces Independent Security Review

eMudhra has apologised after weak cryptographic keys exposed serious security flaws in its certificate systems. The company has revoked affected certificates, commissioned an expert review, and exited TLS certificates business.

eMudhra Apologises for Weak Crypto Keys, Announces Independent Security Review

Indian cybersecurity company eMudhra has issued a public apology after discovering that weak cryptographic keys used in its digital certificate systems could have created serious risks for internet security. The company acknowledged that a scripting error led to the generation of predictable private keys associated with eight intermediate TLS certificate authorities.

The incident raised concerns across the global digital trust ecosystem, prompting major technology companies and security providers to take protective measures. eMudhra has said it is commissioning an independent expert review and preparing a detailed investigation report to explain the failure and outline corrective steps.

What Went Wrong With eMudhra’s Security Keys?

The security issue came to light after a researcher reported that private keys associated with eight of eMudhra’s emSign G3 intermediate Transport Layer Security (TLS) certificate authorities were recoverable.

According to the company, a scripting error caused the certificate authorities to be issued with weak cryptographic keys. These keys were supposed to be generated randomly using 384-bit values, which are designed to be extremely difficult to predict.

However, the affected keys were reportedly generated using simple values: 4, 56, 66, 115, 155, 156, 230 and 237. Such predictable keys could undermine the security guarantees expected from digital certificates.

Digital certificates help browsers and operating systems verify the identities of websites. If an attacker gains control of trusted certificate-signing capabilities, they may be able to create fraudulent certificates and make malicious websites appear legitimate.

eMudhra Issues Public Apology

Acknowledging responsibility, eMudhra said the failure originated within its own systems and apologised to customers, industry partners and the wider Web Public Key Infrastructure (WebPKI) community.

The company recognised that customers and technology partners expected stronger safeguards from a cybersecurity organisation. It also accepted that its internal procedures had failed to prevent the problem.

WebPKI is the framework that enables browsers and operating systems to establish trust in websites through digital certificates. Weaknesses in this system can affect confidence in online communications and website authentication.

The apology comes as the company faces scrutiny over the controls and processes used to generate and manage cryptographic keys.

Company Says Affected Certificates Were Revoked

eMudhra stated that it removed the affected intermediate certificate authorities from service after confirming the issue. According to its statement, the certificates were revoked within 14 hours of confirmation.

The company said the weak keys had been present in its systems since April 2025. However, based on its investigation so far, the affected intermediate authorities had not issued publicly trusted end-entity certificates.

eMudhra also reported that it had found no evidence of a compromise involving its infrastructure or customer data.

These assurances describe the company's findings to date and do not eliminate the seriousness of the underlying security failure. The incident has highlighted the importance of robust key-generation processes, independent checks and continuous security monitoring.

Independent Expert Review and Root-Cause Analysis

To address concerns about the incident, eMudhra has announced plans to appoint an independent expert to examine the failure and review its internal procedures and security controls.

The company also intends to publish a comprehensive root-cause analysis through the Common CA Database (CCADB) process. The report is expected to explain how the weak keys were generated, why existing controls failed to detect the problem and what corrective measures will be introduced.

The review could help identify gaps in testing, software development and certificate-authority operations. Its findings may also provide information for customers, industry partners and other participants in the digital certificate ecosystem.

eMudhra Exits TLS Certificate Business

Following the controversy, eMudhra announced that it would exit the TLS certificate business. The company said it would transition its existing TLS customers to alternative certificates without charging them.

The move follows actions by major technology companies, including Apple, Google, Microsoft and Mozilla, which blocked the affected eMudhra certificates after being notified of the issue. Cloudflare and other providers also introduced security measures in response.

These steps were intended to reduce the potential risks associated with the affected certificates and protect users from possible misuse.

Government Investigation Adds to Security Scrutiny

The incident has also attracted attention from Indian authorities. The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the matter.

Earlier, eMudhra co-founder Kaushik Srinivasan acknowledged that failures in the company's internal controls contributed to the incident. He attributed the issue to a scripting error and admitted that the process should have been checked more carefully.

The government investigation, combined with the independent review announced by eMudhra, is expected to bring further scrutiny to the company's security practices and the circumstances surrounding the failure.

Conclusion

eMudhra's weak cryptographic keys incident highlights the importance of strong security controls in the global digital certificate system. Although the company says it found no evidence of misuse or customer-data compromise, the failure exposed shortcomings in its key-generation procedures. Its independent expert review, root-cause analysis and customer transition measures will be important steps in addressing concerns and rebuilding trust. The findings may also offer lessons for other certificate authorities about preventing similar security failures.