The Company has disclosed that ‘weak’ private cryptographic keys linked to eight ‘intermediate certificates’ were compromised.
As per the Company’s press release dated October 21, 2026, the private keys associated with the eight intermediate certificates were created on April 30, 2025. During the key generation process, a flaw produced a second set of weak keys, alongside the original ‘strong’ keys, eMudhra said in a press release on Wednesday, October 21, 2026.
It has set off alarm bells globally over the possibility that malicious actors could exploit the keys to impersonate websites and intercept supposedly secure connections.
- The issue came to light only because an independent researcher, under the alias ‘Wayne’, reverse-engineered and uncovered the keys. The researcher then flagged the security risk to major browser companies such as Apple, Google, Microsoft, and Mozilla who have since blocked all eight of the intermediate certificates in question.
- Shortly after, browser makers, operating systems vendors, web infrastructure companies like Cloudflare, app developers, and security teams rolled out updates to handle the security risk.
- eMudhra has said that there has been no breach of its own internal systems. The company also denied any impact on the Indian Digital Signature Certificate (DSC) and eSign services it runs in the country.
- The Company mentioned its global TLS business accounts for only around 1% of revenue and it’s working with the effected customers.
- The IT Ministry also issued a statement emphasising the separation between eMudhra’s two service areas.
Cybersecurity researcher Karan Saini said “It is beyond comprehension how a company primarily selling solutions around cryptography had no systems in place to alert them of cryptographic insecurity for intermediate keys generated by them for over a year and a half”.
“If you are running a Certificate Authority [a trusted organisation that issues digital certificates], then it does not get any more serious than this. The risk is the same for any device that has not been told to ignore these certificates from eMudhra. Devices are going to trust these certificates blindly and that creates an opportunity for a motivated adversary to listen in on and trivially decrypt what the device’s users would have assumed to be secure,” Suman Kar, the CEO of cybersecurity consulting firm Banbreach, said.
The subject incident may seem to appear marginal but can have wide implications that only will be known in due course. eMudhra’s DSC and esign business is very sensitive in nature and hence the regulator can raise some very tough questions to the Company.