A security flaw in the digital certificate infrastructure of eMudhra, a BSE-listed company, has prompted major technology firms to block affected certificates. According to Inc42, researchers discovered that eight private keys underpinning part of the company's certificate authorities were generated using predictable, extremely small numbers. These keys were not stolen from internal systems but were reconstructed from publicly available certificates, raising concerns about the reliability of digital trust infrastructure.
The vulnerability originated during a key-generation ceremony on April 30, 2025. eMudhra stated that a process error produced a secondary batch of vulnerable keys, which staff mistakenly utilized when preparing certificates. On October 17, 2026, a researcher identified as Wayne demonstrated control over the keys by signing messages with them, and Mozilla independently confirmed the recovery of the same values. The compromised set comprised six keys for website security and two for code signing.
In response, Google, Mozilla, Apple, and Microsoft moved to distrust the affected certificates. Mozilla blocked the certificates in Firefox within hours of the report, while Google scheduled the removal of eMudhra’s root certificate authority from its Chrome Root Store for October 27, 2026. Cloudflare also updated its critical services, noting that its investigation had not identified active exploitation on its own platforms. The incident has also affected the market, with eMudhra shares dropping to their 20% lower circuit limit at ₹431.55 on the BSE.
eMudhra explained that the issue was limited to eight intermediate authorities, leaving its root CA private keys and Indian digital signature operations, which run on separate infrastructure, intact. The affected global TLS business contributes approximately 1% of the company's revenue. The company is working with customers to provide replacement certificates and is investigating the root cause of the key-generation error.
India’s CERT-In warned that the vulnerable code-signing keys could allow malicious software to appear signed by a trusted publisher. The Internet Freedom Foundation is preparing representations for the IT ministry and the Controller of Certifying Authorities regarding the vulnerability. Google is also reviewing whether eMudhra’s other certificate authorities should remain in Chrome's trust store, while the company investigates whether the keys were accessed before revocation.