eMudhra apologises over weak crypto keys, will conduct expert review

eMudhra has issued a public apology over the incident that rattled the entire internet last week. It was found that eMudhra was using shockingly weak security keys for issuing digital certificates for websites. “The flaw was ours,” the Indian cybersecurity firm said.“We want to apologise directly to our customers and to the broader WebPKI community, both of whom were entitled to expect better from us,” eMudhra said in a statement. “Also to our partners, who have had to field questions that are ours to answer.”WebPKI, or Web Public Key Infrastructure, refers to the global trust framework which allows web browsers and operating systems to verify the identity of websites and platforms via digital certificates.“Last week, a security researcher reported that the private keys associated with eight of our emSign G3 intermediate TLS CAs were recoverable,” the statement added. “They were right. The flaw was ours. A script error resulted in issuing CA’s with weak keys.” In eMudhra’s case, eight such keys were supposed to be generated randomly with 384 bits, or numbers about 116 digits long. But due to a scripting error, the keys were found to be shockingly simple to guess and crack. The keys were 4, 56, 66, 115, 155, 156, 230, and 237.eMudhra says no misuse of affected certificatesThe company confirmed that within hours of first hearing about the weak keys, it had removed them from its systems. “The affected intermediate CAs were revoked within 14 hours of our confirming the issue," the statement said. While the weak keys have been in eMudhra’s systems since April 2025, the company assured that they had not been misused. “Based on our investigation to date, the affected intermediates had not issued publicly trusted end-entity certificates, and there has been no compromise of our infrastructure or customer data,” it added. To follow-up on the incident, eMudhra says it will issue a full root-cause analysis through the Common CA Database (CCADB) process. “It will explain what went wrong, why our controls failed to detect it, and the changes we are making as a result,” the company said.Alongside this, eMudhra said that it was bringing experts to review the procedures within the company. “We are also commissioning an independent expert to review the incident and the procedures and controls followed by us,” the company added. “Nothing is more important in our business than the trust placed in us by our customers and the broader digital-trust ecosystem.”After the incident, eMudhra announced its exit from the TLS certificate business. The company confirmed that it was moving all its TLS customers to “alternate certificates at no cost.”Do note that Apple, Google, Microsoft and Mozilla subsequently blocked the impacted eMudhra certificates shortly after they were notified. While Cloudflare and other providers issued security fixes.Previously, eMudhra co-founder Kaushik Srinivasan accepted that the incident happened due to a failure within the company’s control systems. “Our control and failure lapses happened. It was a script error. We should have checked. It did not happen,” he told India Today Tech.The Ministry of Electronics and Information Technology (MeitY) has also constituted a special team to investigate the incident.- Ends