eMudhra Cybersecurity Issue: Weak Certificate Keys Raise Global Website Security Concerns
A cybersecurity issue involving eMudhra, an Indian digital identity and security solutions provider, has raised concerns about the reliability of digital certificates used to secure websites and online communications. The incident concerns eight intermediate certificate authority certificates whose private cryptographic keys were generated with insufficient randomness.
The weakness could potentially allow an attacker to recover the affected private keys and create fraudulent certificates that appear trustworthy to browsers and other software. Such certificates could be used to impersonate legitimate websites and, under certain circumstances, facilitate attacks on encrypted communications.
The Indian Computer Emergency Response Team (CERT-In) issued a security advisory on October 21, 2026, warning organisations and users about the risks associated with the affected certificates. Google, Mozilla and other technology companies have also taken steps to block the compromised certificates.
What Happened at eMudhra?
According to eMudhra's statement published on October 21, the issue originated during a cryptographic key-generation exercise conducted on April 30, 2025.
The company said a flaw in a key-generation procedure created a second set of weak keys alongside the intended strong keys. The weaker keys were subsequently published as part of the affected intermediate certificate authorities used in its global website security business.
The problem was not a general weakness in the underlying P-384 elliptic-curve cryptographic algorithm. Instead, CERT-In explained that the affected private keys had been generated with insufficient cryptographic randomness, making them susceptible to rapid recovery.
Cryptographic keys must be generated using sufficiently unpredictable values. If a private key can be guessed or reconstructed from publicly available information, an attacker may be able to misuse it to create certificates that appear to have been issued by a trusted authority.
The incident has raised questions about key-generation procedures, quality assurance and the safeguards required at organisations responsible for establishing trust across the internet.
Why Digital Certificates Matter
Digital certificates are an essential part of modern internet security. When a user visits a website using HTTPS, the browser checks its digital certificate to help establish that the website is presenting a valid identity and that the connection can be secured.
Certificate authorities issue and manage certificates that browsers and operating systems may trust. Intermediate certificate authorities operate beneath a root authority and can be authorised to issue certificates within a defined trust structure.
If the private key belonging to an intermediate authority is compromised, an attacker could potentially create fraudulent certificates for websites they do not control. If a browser or application continues to trust the affected certificate chain, the fraudulent certificate could be accepted under certain circumstances.
This could enable website impersonation and potentially support man-in-the-middle attacks, in which an attacker intercepts or alters communications between a user and a service.
The CERT-In advisory also identified potential risks involving compromised code-signing keys, which could be misused to make malicious software appear to have a trusted digital signature.
These are potential consequences of the weakness. They should not be interpreted as proof that attackers successfully used the affected keys or that user information was stolen.
Browser Companies Introduce Protective Measures
Following the disclosure, major technology companies took steps to prevent the affected certificates from continuing to be trusted.
Google's Chrome Security team reported on October 20 that it had blocked the public-key identifiers associated with the affected intermediate certificate authorities. The company said the protection was delivered through a Chrome security update mechanism without requiring users to install a conventional browser update or restart Chrome.
Mozilla also blocked the affected certificates through its certificate revocation system and issued additional Firefox security updates for certain configurations. Other technology companies, including Apple and Microsoft, took steps to address the issue within their respective trust systems.
These actions are intended to reduce the risk that browsers will accept certificates associated with the affected keys. However, protection may vary across applications, operating systems and devices. Some software maintains its own certificate store or may not receive the same revocation information automatically.
Google also announced plans to remove the emSign ECC Root CA - G3 root certificate from the Chrome Root Store. This measure may cause some legitimate certificates that rely on the affected trust chain to stop working in Chrome unless website operators migrate to an alternative trusted certificate hierarchy.
CERT-In Issues Security Advisory
CERT-In's advisory identifies organisations, government departments, enterprises, internet service providers, software vendors, application developers and website administrators among the groups that should review their systems.
The agency recommends installing the latest security updates for supported browsers, operating systems and other affected software. Organisations should also identify whether their services rely on certificates issued under the affected intermediate authorities and replace those certificates where necessary.
Website administrators should work with their certificate providers to obtain replacement certificates from an appropriate trusted authority. System administrators and developers should review certificate validation arrangements and ensure their software receives updated trust information.
Users should keep their browsers and devices updated and avoid bypassing certificate warnings. A browser warning may indicate that a website's identity cannot be verified properly, and ignoring it can expose users to unnecessary risks.
eMudhra Says Indian Digital Signature Services Are Unaffected
eMudhra has stated that the issue is limited to eight intermediate authorities associated with its international website security business. The company said its infrastructure was not compromised and that it had found no evidence of a data breach.
It also said its Indian digital signature certificate and eSign services remain unaffected because those operations use separate infrastructure.
The distinction is important because the company's international website certificate business and its domestic digital signature services operate under different arrangements. CERT-In's advisory likewise distinguishes the affected global website certificate operations from eMudhra's Indian digital signature certificate and eSign services regulated by the Controller of Certifying Authorities.
eMudhra said it was investigating the root cause and working with customers to replace affected certificates. The company also acknowledged that the incident could create reputational risks.
The company's statements do not remove the need for independent technical verification and continued monitoring. Organisations using the affected certificate chains should rely on current technical guidance and confirm that replacement certificates and software updates have been properly implemented.
No Confirmed Malicious Exploitation Established in Public Disclosures
Google reported that no TLS certificates chaining to the six affected website-certification intermediates had appeared in Certificate Transparency logs before its blocking action. eMudhra also stated that the affected intermediate authorities had not issued certificates to end users.
As of the public disclosures cited in the October 21 CERT-In advisory, confirmed malicious exploitation of the affected keys had not been established.
Certificate Transparency logs provide a way to monitor publicly trusted certificates and help detect suspicious issuance. However, the absence of a certificate in those logs should not be interpreted as proof that every possible form of misuse is impossible, particularly across software and systems with different certificate-validation arrangements.
The incident demonstrates why reliable key generation, certificate monitoring, prompt revocation and coordinated action among browser providers are important to internet security.
What Users and Businesses Should Do Next
Users should update their browsers and operating systems through official channels and follow security guidance issued by their software providers. Businesses should review certificate inventories, contact their certificate providers where relevant, replace affected certificates and test their services after making changes.
Technology teams should also check whether applications, servers, containers and embedded devices rely on independent certificate stores that require separate updates.
The eMudhra incident highlights how a flaw in a relatively small number of certificate authorities can create security concerns across a much wider digital ecosystem. Although protective measures have been introduced, organisations must verify that their own systems have received the required updates.
The investigation into the key-generation failure and the wider remediation effort will be important in determining the full operational impact. For now, the central priorities are to remove trust in the affected certificates, replace them where necessary and maintain reliable certificate-management practices across internet-connected systems.
