eMudhra flags weak keys in eight certificate authorities, rules out data breach

SENSEX 73,443.95

 -408.95

NIFTY 22,706.60

 -182.35

CRUDEOIL 9,372.00

+ 61.00

GOLD 146,000.00

 -519.00

SILVER 209,234.00

 -2,251.00

SENSEX 73,443.95

 -408.95

NIFTY 22,706.60

 -182.35

NIFTY 22,706.60

 -182.35

CRUDEOIL 9,372.00

+ 61.00

CRUDEOIL 9,372.00

+ 61.00

GOLD 146,000.00

 -519.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

A flaw during a key generation event led to weak keys being published to browser root stores, prompting the company to work with affected customers and browser root programmes on replacement certificates.

By BL Chennai Bureau

Updated - October 21, 2026 at 01:36 PM.

The issue came to light originally as an independent researcher discovered on October 17 that the weak keys could potentially be reverse-engineered, especially using AI, and also reported the issue to major browser root programmes operated by Apple, Google, Microsoft and Mozilla. | Photo Credit: istock.com

Digital trust services provider eMudhra informed exchanges on Wednesday that a flaw during a key generation event led to weak cryptographic keys being published for eight of its intermediate certificate authorities (CAs), prompting concerns over their trustworthiness.

eMudhra said it was working directly with potentially affected customers to provide replacement certificates and prevent disruptions to critical services. “We are also coordinating with the browser root programmes while continuing its investigation into the root cause,” it added.

In a statement issued on Wednesday, the company said the affected certificate authorities were created under its ECC root during a key generation ceremony on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs). A flaw in the process led to a generation of a second set of weak keys alongside the original strong keys, with the weak keys subsequently published to browser root stores, as per eMudhra.

eMudhra said its infrastructure had not been compromised and there had been no data breach. “All physical and logical security controls remained intact,” it said.

eMudhra clarified that the incident had no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses, which operate on infrastructure completely separate from its global TLS operations. Its DSC and eSign services in India continue to function normally, it said.

“The affected global TLS business is a very small part of eMudhra’s operations and accounts for around 1% of the company’s revenue. However, this may have some reputational risks on eMudhra which cannot be quantified,” it said.

eMudhra said it was working directly with potentially affected customers to provide replacement certificates and prevent disruptions to critical services. It is also coordinating with the browser root programmes while continuing its investigation into the cause of the flaw, it added.

The issue came to light originally when an independent researcher discovered on October 17 that the weak keys could potentially be reverse-engineered, especially using AI, and also reported the issue to major browser root programmes operated by Apple, Google, Microsoft and Mozilla.

Indian cybersecurity authority CERT-In is yet to weigh in on the issue.

Following the incident, eMudhra’s stock was down 108 points or 20% to 432.0 at 11:46 am at NSE

Published on October 21, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers