Eight digital certificate authorities operated by Bengaluru-based technology company eMudhra were found to have weak cryptographic keys, prompting the company to revoke them and browser makers to block them.
What is eMudhra?
eMudhra is an Indian digital trust and cybersecurity company. It provides digital signature certificates and electronic signing services in India, as well as digital certificates used by browsers and operating systems to establish secure connections with websites.
Its digital signature services allow people and organisations to sign documents electronically. Its international website security business, which includes its emSign certificates, helps browsers verify that a website is who it claims to be.
What happened?
On October 17, 2026, a security researcher reported that private keys linked to eight intermediate certificate authorities operated by eMudhra had been compromised. Google and Mozilla independently confirmed the weakness.
A certificate authority, or CA, is an organisation trusted to issue digital certificates. A root CA sits at the top of this trust system, while intermediate CAs issue certificates to websites and other services under that authority.
eMudhra said the eight affected intermediate authorities were created in April 2025. It revoked them after learning of the issue.
How did the flaw occur?
Digital certificates rely on cryptographic keys, which are strings of data used to establish identity and protect communications. Private keys must be sufficiently random and difficult to guess or calculate.
India’s cybersecurity agency CERT-In said the affected keys had been generated with insufficient randomness. Their values were so small that they could be recovered almost instantly from their corresponding public keys.
eMudhra said: “A flaw in the key generation ceremony caused a wrap / unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores.”
The company said it was investigating how the weakness occurred.
What could an attacker do?
If an attacker obtains a certificate authority’s private key, they could potentially create fraudulent certificates for websites they do not control. If the certificates were trusted by a browser, and the attacker could intercept a connection, they could impersonate a legitimate website or interfere with encrypted traffic.
However, Google said no website certificates linked to the six affected TLS intermediates had appeared in public Certificate Transparency logs before it blocked them. eMudhra also said none of the affected authorities had issued certificates to end users. Public disclosures have not established confirmed malicious use of the keys.
