eMudhra exits global certificate business after security lapse
eMudhra exits global website-security certificate business after cryptographic key generation lapse exposed eight intermediate certificate authorities, raising major security and trust concerns.
eMudhra has decided to exit the global website-security certificate business following a serious lapse in the generation of cryptographic keys that left eight intermediate certificate authorities vulnerable, raising questions over the company's security controls and its ability to maintain trust in a business built around digital security. The company's board decision comes amid global scrutiny of the incident and action by major browser makers to block the affected certificates.
The IT ministry has also constituted a special team to investigate the matter. While the company has cited reputational concerns and commercial challenges in the global secure sockets layer and transport layer security (SSL/TLS) business, the exit follows a failure that went undetected for about 18 months. Kaushik Srinivasan, eMudhra's co-founder, told Fe that the script generated elliptic curve cryptography key pairs as intended, but a specific fault made the keys weak.
The output was not reviewed after the ceremony, he said, attributing the failure to a script error and human oversight. The company learnt of the problem only on October 17, 2026, after an independent researcher flagged it, and revoked the affected issuer within 14-15 hours. The delay in discovering the weakness, however, raises questions about why a critical cryptographic operation lacked effective validation checks.
Security researcher Scott Helme, who recovered all eight private keys from public certificates in less than a second, said one of the keys was simply the number four, while others included 56 and 115. In his October 20 technical analysis, Helme said the keys had effectively been exposed since the certificates were created in April 2025, leaving a 17-month window during which they could have been recovered by anyone examining the certificates.
Ian Carroll, another security researcher, described the keys in a public discussion hosted by Mozilla as inherently weak and warned that the problem could not be contained simply by revoking the affected certificates. The Internet Freedom Foundation, a digital rights organisation, has sought an incident report, an independent audit and a regulatory inquiry from eMudhra, CERT-In and the IT ministry.
Weak keys raise security concerns CERT-In said the affected P-384 private keys had values smaller than 256 and could be recovered almost instantly from their corresponding public keys. Google said no website certificates linked to the six affected web-issuing authorities had appeared in certificate transparency logs before its blocking action. However, researchers have warned that software which does not routinely check certificate revocation could remain exposed until its trusted certificate lists are updated.
Two of the keys were also intended for code signing, raising the possibility of forged software signatures. The affected business serves a single customer in North America, with about 30,000 certificates, and accounts for roughly 1% of revenue, he said. He maintained that eMudhra's Indian digital signature certificate and eSign operations run on separate infrastructure and remain unaffected. The company has cited reputational concerns, compliance costs, operational complexity and competition from free certificate providers as factors behind its exit.
It has promised internal reviews, independent assessments and tighter security controls. The episode, however, leaves questions over how a basic failure in key generation escaped detection despite the company's claim that its global certificate operations had undergone independent audits. eMudhra shares fell more than 20% on Thursday, taking their decline to over 36% across the last two trading sessions.
