Global technology giants, including Google, Mozilla, Apple, and Microsoft, have taken coordinated action to block digital certificates associated with Bengaluru-based eMudhra. The move follows the discovery of a significant security flaw in the company’s systems responsible for generating cryptographic keys. This vulnerability, which potentially exposed secure online communications to interception, has prompted immediate protective measures across the internet's infrastructure.
The issue was brought to light on October 17 by an independent security researcher identified as Wayne. The flaw concerned eight intermediate certification authority (CA) certificates, where the private keys were created with insufficient randomness. This lack of complexity meant the keys were potentially susceptible to being deciphered. Of the affected certificates, six were designated for authenticating websites, while the remaining two were intended for digitally signing software.
Cryptographic keys serve as the foundation of digital trust on the internet. A private key, which must remain secret, is used to verify the identity of entities such as websites or software publishers. Because the keys generated by eMudhra lacked sufficient randomness, experts warned that attackers could potentially reconstruct them in seconds. Such a breach would have enabled malicious actors to issue fraudulent certificates, impersonate legitimate websites, or present malicious software as trustworthy.
In response to the report, browser companies acted swiftly. Google deployed an emergency update to Chrome last week to block the compromised keys, while Mozilla utilised its centralised certificate revocation system to secure Firefox users. These measures were implemented automatically without requiring browser updates or manual restarts from users. Apple and Microsoft subsequently joined the effort to mitigate risks by blocking the affected certificates within their respective environments.
eMudhra, founded in 2008, is one of India’s largest digital identity and security companies. According to the firm’s May 2026 investor presentation, it commands approximately 38% of the market share by value in the digital signature certificate sector. Operating across more than 35 countries, the company provides essential authentication technology for financial institutions, businesses, and government organisations.
Addressing the incident in a statement on October 21, eMudhra acknowledged that the vulnerability originated during a key-generation exercise conducted on April 30, 2025. The company explained that a process error resulted in the creation of a secondary set of weak cryptographic keys alongside the intended strong ones, and these weaker versions were subsequently published to browser trust stores. eMudhra maintained that its infrastructure was not compromised, no data breach occurred, and that its physical and logical security controls remained intact.
This incident has drawn attention to the critical reliance of the internet on a system of trust between browser companies and certification authorities. Certification authorities form the backbone of the public key infrastructure (PKI), which allows users to verify identities and establish encrypted connections, such as those indicated by the HTTPS protocol. The lapse at eMudhra has sparked broader discussions regarding the safeguards maintained by organisations entrusted with securing major portions of the digital landscape. While India maintains a specific domestic licensing framework for certifying authorities under the Information Technology Act, 2000, this incident specifically impacted the global website-certificate infrastructure.
Comments