Flawed Security Keys Force Digital Certificate Firm eMudhra Out of Global Market

2026-10-25 companies

Bengaluru, Sunday, 25 October 2026.
Indian cybersecurity provider eMudhra will exit the global certificate market after researchers discovered eight cryptographic keys were generated with absurdly weak numbers—one simply set to four.

A Decade of Growth Built on Government Trust

Bengaluru-based eMudhra, founded in 2008 as 3i Infotech Consumer Services Limited, transformed into a cybersecurity powerhouse by leveraging credentials from high-profile Indian government contracts. The company issued millions of digital certificates for India’s tax filings, customs declarations, and military communications, accumulating trust across domestic systems[GPT]. By 2018, eMudhra had secured approval as a root certificate authority from major browsers including Mozilla and Microsoft, becoming the only Indian firm whose certificates were universally trusted across all major platforms[1]. This trust was built on claims of handling 35 million certificates—representing 3% of India’s population—through partnerships with the Indian Army and defense establishments[1].

Critical Flaw Emerges from a Flawed Process

On April 30, 2025, during a formal key generation ceremony, a software script error produced eight compromised intermediate certificate authority (CA) private keys with dangerously low entropy[3][6]. The weak keys, ranging from 3 to 8 bits of randomness (with one key simply set to the number 4), stood in stark contrast to proper cryptographic standards requiring approximately 384 bits for P-384 elliptic curve certificates[5]. Researchers demonstrated the vulnerability by signing arbitrary certificates, including a test domain that proved the flaw’s severity[5]. The compromised keys chained up to eMudhra’s emSign ECC Root CA - G3, creating a pathway for potential man-in-the-middle attacks and unauthorized certificate issuance[3][5].

Global Tech Giants Respond Swiftly to the Breach

The discovery on October 17, 2026, triggered immediate action from major technology vendors. Google, Mozilla, Apple, and Microsoft blocked the eight affected certificates within days, with Firefox and Chrome taking action on October 17, Apple following on October 19, and Microsoft completing the revocation on October 20[1][3][5]. The incident exposed vulnerabilities across countless systems, with Google identifying 30,791 affected certificates among 30,800 issued by InCommon alone, primarily affecting educational institutions facing immediate replacement deadlines[1]. Security researchers warned that the breach’s impact extended beyond browsers to include email servers, IoT devices, Docker containers, and outdated command-line tools that maintained their own certificate stores[5].

eMudhra’s Strategic Exit Amid Scrutiny and Investigations

Facing unprecedented operational and reputational damage, eMudhra announced on October 22, 2026, its decision to exit the global SSL/TLS certificate business entirely[1][2][5]. The company’s non-executive chairman, Venkatraman Srinivasan, cited the incident’s disproportionate scrutiny compared to the business’s modest revenue contribution—just 1% of total earnings—as a key factor in the withdrawal decision[2]. The announcement followed India’s Ministry of Electronics and Information Technology (MeitY) forming a dedicated team in October 2026 to investigate the certificate breach[1]. eMudhra simultaneously revoked all compromised certificates and halted new issuances under its G3 root, though the company maintained that its root CA private keys and other intermediate certificates remained unaffected[6].

Technical Failures and Human Errors: The Root Causes

Investigations revealed a cascade of failures beginning with the April 2025 key generation ceremony. A software script during the wrap/unwrap process produced weak keys with entropy as low as 3 bits—the equivalent of a password with just 3 characters[6]. eMudhra officials acknowledged multiple human errors in the certificate issuance process, stating that mathematical models facilitated by AI were used to corroborate the findings[1]. The flaws extended beyond technical implementation to include governance issues, with Mozilla contributor Nick Lamb admitting in 2018 that he had never heard of the entity before its certification application, raising questions about due diligence standards[1].

Ongoing Risks and Remediation Challenges

Despite eMudhra’s exit from the TLS business, the fallout continues across global systems. Organizations face complex remediation processes including certificate reissuance, trust store updates, and continuous monitoring for affected certificates[3][6]. Security firms like Qualys and Palo Alto Networks have released specific tools and guidance, with Qualys providing QQL queries and vulnerability identifiers (QID 48395, CVE-2026-111943) to help enterprises identify compromised assets[6]. The incident has also raised broader questions about certificate authority governance and the adequacy of current trust models in preventing similar failures[1][alert! ‘The long-term impact on India’s digital signature ecosystem and international trust in Indian CAs remains uncertain as investigations continue’].

Sources

Cybersecurity eMudhra