eMudhra Board to Weigh Structural Changes Following Key-Generation Script Errors

The board of eMudhra is scheduled to consider structural changes and new safeguards following the discovery of script errors in eight of its certificates. The issue was identified during a key-generation ceremony held on April 30, 2025, according to co-founder Kaushik Srinivasan.

The company is currently completing a root-cause analysis and plans to release a public statement after re-verifying its findings. Srinivasan noted that the script error triggered the creation of weak keys during a wrap-unwrap process meant for global operations. However, no certificates were issued from these specific issuing CAs because they never went into production. Independent researchers, browsers, and the external ecosystem have assessed the incident, confirming that no damage occurred.

Srinivasan clarified that the event was not a result of an infrastructure breach, data breach, or physical or logical control breach, and it had no impact on other company operations. The deviation occurred when additional wrap-and-unwrap methods were introduced to export keys for global operations, a process approved by the head of PKI operations. Although a maker-checker control was in place, the script errors were not caught before running against the hardware security modules.

Addressing concerns regarding Indian users, Srinivasan assured that the Indian digital signature certificate (DAC) business operates on a completely isolated and separate infrastructure. He confirmed that checks and rechecks showed no similar incidents affecting Indian government services, such as GST filings and income-tax returns. The company has been working with regulators to provide necessary information.

To prevent future occurrences, eMudhra plans to integrate artificial intelligence and machine-based oversight to pair with human processes and maker-checker controls. Srinivasan noted that computational and mathematical checks are necessary to identify weaknesses that cannot be spotted by visual inspection alone.

Regarding browser platforms like Google and Apple, eMudhra is responding to inquiries and addressing perception concerns for a single affected customer in the US by providing alternative pathways and transition support. The affected roots have been revoked, and the chain of trust has been broken.

"Incidents involving script errors and key-generation processes highlight the critical need for rigorous, automated validation layers in digital infrastructure businesses. As companies scale their global operations, relying solely on traditional human oversight and maker-checker controls is no longer sufficient. Integrating advanced technological safeguards, such as AI-driven computational checks, is essential for maintaining systemic security, protecting customer trust, and ensuring regulatory compliance across international markets." — Dr. Shishir Gupta, Founder & CEO, StartupLanes