Bengaluru-based digital trust company eMudhra is facing its biggest credibility crisis after researchers found that private cryptographic keys linked to eight of its global TLS intermediate certificates were so weak that they could be reconstructed from publicly available certificate data.

The flaw raised fears that attackers could create fraudulent HTTPS certificates and impersonate legitimate websites, prompting browser makers to block eMudhra certificates, investors to dump the stock and the government to open an investigation.

The issue came to light on October 17, 2026, when Mozilla cryptography engineer Dennis Jackson reported that private keys associated with eight eMudhra intermediate certificate authorities could be recovered because of insufficient randomness during their creation.

eMudhra creates digital “identity cards” for websites, called TLS certificates. These certificates tell your browser that a website is genuine and that the connection is secure.

To issue such certificates securely, eMudhra needs a private key -- essentially a highly secret digital password. But in April 2025, a technical error during the key-creation process meant that eight of these private keys were generated in a way that made them weak and predictable.

In one reported case, the “secret” key was simply the number 4. That meant anyone who knew how the flaw worked could, in theory, recreate the key from public information.

If attackers had obtained those keys, they could have created fake security certificates and made malicious websites look legitimate. However, eMudhra says the weak keys were never used to issue real customer certificates, and no customer data was compromised.

Once researchers flagged the problem, browser companies such as Google, Mozilla, Apple and Microsoft blocked the affected certificates. eMudhra also revoked them, which means browsers will no longer trust them.

In short: eMudhra accidentally created weak “master keys” for website security. The keys were not properly random, so they could potentially be guessed or rebuilt. The company says they were caught before being used commercially, and they have now been cancelled.

The affected certificates belonged to eMudhra’s global TLS business, which issues certificates that help websites prove their identity and encrypt traffic. eMudhra said no certificates had been issued from the affected intermediates, its infrastructure was not breached and no customer data was lost.

Why it matters

A certificate authority sits at the heart of internet trust. If its private keys are compromised, an attacker could potentially issue fake HTTPS certificates for websites they do not control, making a malicious site appear authentic in a browser.

Security researchers said the weakness was extraordinary: one of the compromised keys was reportedly the number “4”. That has intensified criticism of eMudhra’s key-generation controls, with technology professionals calling the lapse a fundamental failure in a business whose core product is digital trust.

Browser action and containment

The response was swift. Google’s Chrome Root Program received the report at 18:05 UTC on October 17 and blocked six affected TLS intermediates by 19:45 UTC. Mozilla also blocked the certificates within hours, while Apple devices blocked them from October 19 and Microsoft platforms from October 20.

eMudhra revoked all eight intermediate certificates on October 18. Sectigo, which had cross-signed them, followed on October 19. Mozilla has since removed eMudhra’s root certificate from its trusted list, and Google is removing the relevant root certificate from Chrome while reviewing the status of eMudhra’s remaining root certificate.

CERT-In issued advisory CIAD-2026-0050 on October 21, asking users to update browsers and operating systems and replace affected certificates where necessary.

Government probe

The Ministry of Electronics and Information Technology has constituted a special team to investigate the incident. Officials said the impact on Indian websites and applications was “very limited and for a very short period”.

MeitY also said Digital Signature Certificate and eSign services regulated by the Controller of Certifying Authorities remain completely unaffected. eMudhra has separately maintained that its Indian DSC, eSign and enterprise businesses run on infrastructure separate from its global TLS operations.

Market fallout

The controversy hit eMudhra’s shares hard. The stock fell 20% on October 21 and hit the lower circuit after the security flaw became public and major browser ecosystems moved to distrust the affected certificates.

Investor concern centres on reputational damage, potential customer attrition in the global TLS business and the cost of replacing certificates and strengthening controls.

eMudhra said it is working directly with customers likely to be affected to issue replacement certificates and protect critical services.

In its public statements, eMudhra has sought to draw a sharp line between the affected global TLS intermediates and its Indian certification business. It said the eight weak intermediates were among several in its global TLS operation, were revoked quickly and were never used to issue certificates.

The company also said its physical and logical security controls remained intact and that there was no cyber security incident arising from commercial use of the vulnerable keys. A senior company official said the weak keys were created by eight of 40 certifying authorities but were never put to commercial use.

As of today, the affected certificates have been revoked and blocked by major browser and platform root programmes. eMudhra is continuing its root-cause investigation, coordinating with root programmes and replacing certificates for affected customers.

MeitY’s special team is probing what led to the error, while CERT-In has issued mitigation guidance. The immediate technical risk has been contained, but the episode has left a larger question hanging over eMudhra: whether a certificate authority can retain broad trust after a failure this basic in its own key-generation process.