What Is eMudhra Controversy: Indian cybersecurity company eMudhra has come under scrutiny after researchers discovered that eight digital security certificates it issued had dangerously weak secret keys that could be cracked in less than a second. This could have allowed hackers to create fake certificates and impersonate legitimate websites, potentially tricking users into trusting them.
The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the security incident involving eMudhra's digital certificate infrastructure. The incident prompted major technology companies to block the affected certificates over concerns about online security.
However, MeitY clarified that Digital Signature Certificates (DSCs) and eSign services regulated in India remain unaffected.
What Is eMudhra Controversy?
The security flaw came to light on October 17, when a researcher alerted Google and other major technology companies that the private keys associated with the eight certificates were vulnerable.
The certificates were issued under eMudhra's global Public Key Infrastructure (PKI), a system used to verify website identities and establish secure internet connections.
According to Google's Chrome and Android Security Teams, the keys were generated with insufficient randomness, making them vulnerable to recovery. Researchers found that the keys were simple numbers - 4, 56, 66, 115, 155, 156, 230 and 237. All eight keys could be recovered in less than a second.
This could have allowed hackers to create fraudulent security certificates and impersonate trusted websites. For example, someone trying to visit their bank's website could potentially have been redirected to a fake server without realising it.
ALSO READ: SBI Confirms Data Breach: 3,897 Customer Records Exposed Among 3.75 Lakh Dark Web Entries
So far, there is no evidence that the flaw was exploited to carry out an attack.
What Did MeitY Say?
According to ANI news agency, MeitY constituted a special team to investigate the incident involving eMudhra's digital certificate infrastructure.
The Ministry clarified that the incident was limited to eMudhra's international digital certificate business, which operates under a global trust framework and undergoes independent audits, including WebTrust audits conducted by BDO International Limited.
"The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said.
MeitY also said that India's regulated Digital Signature Certificate and eSign services remain unaffected.
eMudhra Acknowledges the Flaw
In an official statement issued on Wednesday, eMudhra acknowledged that a flaw in a key-generation process conducted on April 30, 2025, had resulted in weak cryptographic keys being published.
"A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores," the company stated.
eMudhra said all eight affected intermediate certificates were revoked on October 19 and that none had issued customer certificates. The company maintained that its infrastructure had not been compromised and that no data breach had occurred.
It also clarified that its affected global TLS business accounts for around 1 per cent of its revenue, although the reputational risks arising from the incident cannot yet be quantified.
The Indian Computer Emergency Response Team (CERT-In) has also issued an advisory outlining mitigation measures.
Why Has Controversy Intensified?
The incident has raised questions about how such a fundamental security flaw passed through the certificate-generation process and what it means for internet security.
Digital certificates help browsers establish whether websites can be trusted. The discovery that the eight certificates contained easily recoverable keys raised concerns that attackers could have used them to impersonate legitimate websites.
In response, Google and Mozilla moved to block the affected certificates. Google also announced that it would remove the associated root certificate from Chrome's trusted list starting October 27, potentially affecting websites that still rely on it.