eMudhra Issues Weak Digital Certificates Following Key Generation Error

Bengaluru-based digital certificate provider eMudhra recently faced a major security issue after generating weak private keys during a formal key ceremony held in April 2025. Rather than utilizing standard 384-bit random numbers, one private key was set as the number 4, while others were similarly small whole numbers. The issue stemmed from a step where keys were wrapped and unwrapped for transfer.

A researcher discovered the vulnerable keys and notified Apple, Google, Microsoft, and Mozilla on a Saturday evening. The researcher signed a note eight times using eight private keys belonging to eMudhra. According to reports, the keys were recovered on a laptop in less than a second, and an AI assistant managed to do the same from a single prompt. Mozilla's engineers obtained the keys within two hours.

Major web browsers responded quickly to the report. Chrome and Firefox blocked all eight certificates globally before most users woke up the next morning. Certificate Transparency logs confirmed that no fake certificates were ever issued, and eMudhra officially revoked all eight keys the following day. The Ministry of Electronics and Information Technology (MeitY) stated that the impact was limited and brief, confirming that Aadhaar eSign and digital signature certificates remained unaffected.

Despite the swift action by browsers, the incident raised serious questions about the auditing process for certificate authorities. The weak keys had reportedly passed two independent audits and sat in trust stores for eighteen months before being discovered. Industry observers noted that current audits evaluate procedures rather than the actual cryptographic strength of the generated keys, creating a significant blind spot in web security infrastructure.

While standard browsers blocked the certificates effectively, the vulnerability posed a wider risk to non-browser systems that do not regularly check revocation lists. Various software environments, including language runtimes, server command-line tools, and back-office applications, required emergency patches and updates. Tech companies and platforms, including Go, Node, Debian, Ubuntu, and Python's certifi, pushed fixes following the disclosure.

Businesses and system administrators operating in India have been advised to update their ca-certificates, rotate any systems chained to the emSign ECC root, and apply language runtime updates to prevent potential security vulnerabilities as major browsers phase out the affected roots.

"The eMudhra incident highlights a critical gap in digital infrastructure governance. While browsers reacted swiftly to mitigate immediate risks, the fact that weak cryptographic keys passed independent audits underscores that procedural compliance alone is insufficient. For businesses and startups building on digital identity and web infrastructure, this serves as a stark reminder that automated checks and deeper internal validation mechanisms are essential to protect against systemic vulnerabilities." — Dr. Shishir Gupta, Founder & CEO, StartupLanes