India
oi-Swastika Sruti
Recently, the Indian cybersecurity company called eMudhra became subject to discussion when researchers revealed that there is a serious threat associated with eight certificates, issued by this company. These certificates are considered to be insecure since the private keys for these certificates turned out to be very weak. It takes no more than one second to discover these keys and, thus, to create an imitation website instead of a legitimate one.
eMudhra issued eight certificates with weak private keys, leading major tech firms like Apple, Google, Microsoft, and Mozilla to block them over potential spoofing risks; eMudhra acknowledged the vulnerability and is investigating, with no reported exploitation.
Due to this problem, big technology companies such as Apple, Google, Microsoft, and Mozilla took steps to block the insecure certificates, while Cloudflare and other software vendors implemented security measures to prevent the mentioned above situation.
So far, there are no signs of any exploitation of weak keys to carry out the attack presented in the available sources.
The representatives of eMudhra admitted the presence of this problem and stated that the investigation was still ongoing.
What Is eMudhra And What Does It Do?
The eMudhra company is an Indian digital trust and cybersecurity organization that specializes in providing services in terms of digital identification, authentication, and certification.
This company is considered to be a Certificate Authority (CA). Such companies have a high level of trust because they provide digital certificates used for identifying websites and services on the Internet.
The certificates of websites can be found in users’ web browsers. This helps them identify the connection with the needed website and form an encrypted connection.
It can be said that a digital certificate resembles an ID card on the Internet.
What Went Wrong With The Eight eMudhra Certificates?
The issue involves eight intermediate certificates created on April 30, 2025, according to the information surrounding the incident.
Researchers found that the certificates had private keys that were far weaker than they should have been. The keys were expected to use the P-384 elliptic-curve cryptographic system, which is designed to provide a very large space of possible private keys.
Instead, the private keys reportedly corresponded to the single-byte values 4, 56, 66, 115, 155, 156, 230 and 237.
A single byte can represent only 256 possible values. This made the keys extremely easy to recover compared with properly generated cryptographic keys. Researchers reportedly recovered all eight in less than a second.
Private keys are a critical part of digital certificate security. They help prove that a certificate was issued or used by the legitimate holder of the corresponding key. If an attacker can recover a private key, the security protections that depend on it may be undermined.
The discovery therefore raised questions about the key-generation process used when the certificates were created.
How Could The Flaw Have Put Internet Users At Risk?
The core worry was the possibility of an attacker with access to the vulnerable keys to abuse the certificates to produce fraudulent website certificates.
For instance, there could be an attempt from a criminal to mimic an official website for banks or online shopping sites. In the case where such an attack happened and the fraudulent certificate was accepted, the individual may think they are engaging with the official site.
But this scenario describes the risk from the vulnerability and not a real attack. There is no evidence provided in the information given of the exploitation of the vulnerable keys to steal people’s passwords, banking details or personal information.
This is just a risk from the vulnerability and not an attack. This situation does not indicate that all the websites with eMudhra certificates have been compromised.
Why Did Apple, Google, Microsoft And Mozilla Respond?
Digital certificates are trusted through systems built into browsers, operating systems and other software. When a certificate is found to be unsafe, software providers may need to stop trusting it to prevent potential misuse.
Apple, Google, Microsoft and Mozilla moved to block the affected certificates. Cloudflare and other software providers also introduced security measures in response to the discovery.
These actions are important because removing trust in a compromised certificate can reduce the possibility that it will be accepted during a future attack.
The response also highlights how widely digital certificate infrastructure is used. A weakness in a small number of certificates can require action from multiple companies because browsers, operating systems and online services rely on shared trust mechanisms.
What Has eMudhra Said About The Security Incident?
eMudhra has acknowledged the issue and said it is investigating the eight intermediate certificates created during a key-generation ceremony in April 2025.
In its statement, the company said the incident was limited to the specific certificates and did not affect its root Certificate Authority’s private keys or other intermediate certificates.
The company also said that only one of the eight affected certificates had been deployed in a production environment. According to eMudhra, none of the affected certificates had been used to issue certificates for individual websites.
eMudhra said it had taken steps to contain the affected certificates and was working with browser developers and other operators to protect users.
The company added that its investigation was continuing and that it would share further information as it became available.
These statements describe the company’s position while the investigation remains ongoing. The full technical findings will be important in establishing how the weak keys were generated and whether any additional systems were affected.
What Does The eMudhra Incident Mean For Internet Security?
The incident highlights the importance of generating cryptographic keys correctly. Digital certificates are designed to establish trust between users and online services, but that trust depends on the security of the keys and processes used to create them.
Even a certificate that appears technically valid can create a security risk if its private key is predictable or too weak to protect against recovery.
The response from major browser and software providers shows why certificate security requires ongoing checks, quick action when flaws are discovered and cooperation across the technology industry.
