eMudhra row: Two days after cybersecurity researchers discovered that eight digital security certificates issued by Indian cybersecurity company eMudhra had dangerously weak secret keys that could be cracked in less than a second, the Bengaluru-based company announced on Thursday that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business.
The incident raised questions about how such a fundamental security flaw passed through the certificate-generation process and what it means for internet security.
Why Is eMudhra Shutting Down Its Global Digital Certificate Business?
eMudhra said it was exiting the global digital certificate business amid mounting scrutiny over a major security lapse that triggered a global cybersecurity alert, raising concerns about risks to billions of internet users.
The company cited increasing data sovereignty and compliance requirements, operational complexity, and rising costs associated with running its Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate business as key factors behind the decision. It also said the business had attracted disproportionate social media scrutiny relative to its small share of the company's overall portfolio.
eMudhra said its digital signature certificate (DSC), eSign, enterprise PKI, emSigner, and identity and authentication solutions, including SecurePass and emAS, operate on separate infrastructure and remain unaffected.
Affected customers will receive free certificate replacements through the company's partners. Revocation and certificate-status services will continue until all certificates expire or are replaced. eMudhra will also submit a comprehensive root-cause report to browser programmes.
The company's customers include IT majors Infosys and TCS, as well as government agencies. Its certificates have also been used to secure critical websites, including India's income tax portal.
Meanwhile, eMudhra acknowledged that a flaw in a key-generation process conducted on April 30, 2025, had resulted in weak cryptographic keys being published.
"A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores," the company stated.
eMudhra said all eight affected intermediate certificates were revoked on October 19 and that none had issued customer certificates. The company maintained that its infrastructure had not been compromised and that no data breach had occurred.
What Is the eMudhra Controversy?
The security flaw came to light on October 17, when a researcher alerted Google and other major technology companies that the private keys associated with eight certificates were vulnerable.
The certificates were issued under eMudhra's global Public Key Infrastructure (PKI), which helps verify website identities and establish secure internet connections.
According to Google's Chrome and Android Security Teams, the keys were generated with insufficient randomness, making them vulnerable to recovery. Researchers found that the keys were simple numbers: 4, 56, 66, 115, 155, 156, 230 and 237. All eight could be recovered in less than a second.
The vulnerability could have allowed hackers to create fraudulent security certificates and impersonate trusted websites. For instance, someone attempting to access their bank's website could potentially have been redirected to a fake server without realising it.
MeitY To Investigate Matter
MeitY constituted a special team on Tuesday to investigate the incident involving eMudhra's digital certificate infrastructure.
The ministry clarified that the incident was limited to eMudhra's international digital certificate business, which operates under a global trust framework and undergoes independent audits, including WebTrust audits conducted by BDO International Limited.
"The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said.
MeitY also said that India's regulated Digital Signature Certificate and eSign services remain unaffected.
What Is eMudhra?
eMudhra is one of India's licensed Certifying Authorities (CAs), authorised by the Controller of Certifying Authorities (CCA) under the Ministry of Electronics and Information Technology (MeitY) to issue web security certificates for government websites, including the Unique Identification Authority of India (UIDAI) and the income tax portal.
The company also provides digital document-signing services, enterprise Public Key Infrastructure (PKI) solutions, and other identity and authentication services in India.