eMudhra Reports Weak Cryptographic Keys in Eight Certificate Authorities, Rules Out Data Breach

Digital trust services provider eMudhra informed stock exchanges on Wednesday that a flaw during a key generation event led to the publication of weak cryptographic keys for eight of its intermediate certificate authorities (CAs). The disclosure prompted immediate concerns regarding the trustworthiness of the affected certificates.

The issue initially came to light when an independent researcher discovered on October 17 that the weak keys could potentially be reverse-engineered, particularly using artificial intelligence. The researcher reported the vulnerability to major browser root programmes operated by Apple, Google, Microsoft, and Mozilla.

According to eMudhra, the affected certificate authorities were created under its ECC root during a key generation ceremony on April 30, 2025, utilizing FIPS 140-2 Level 3 Hardware Security Modules (HSMs). The company explained that a process flaw caused a second set of weak keys to be generated alongside the original strong keys, with the weak keys subsequently published to browser root stores.

Despite the cryptographic flaw, eMudhra maintained that its infrastructure had not been compromised and confirmed that there was no data breach. The company stated that all physical and logical security controls remained intact throughout the event.

The firm also clarified that the incident had no connection to its Indian Digital Signature Certificate (DSC) and eSign businesses, which operate on infrastructure entirely separate from its global TLS operations. eMudhra confirmed that its DSC and eSign services in India continue to function normally.

Regarding the business impact, eMudhra stated that the affected global TLS business accounts for approximately 1% of the company's revenue. However, the firm noted that the incident may carry unquantifiable reputational risks. Following the development, eMudhra's stock dropped 108 points, or 20%, to 432.0 at 11:46 am on the National Stock Exchange (NSE).

eMudhra announced that it is working directly with potentially affected customers to provide replacement certificates and prevent disruptions to critical services. Additionally, the company is coordinating with browser root programmes while continuing its investigation into the root cause of the flaw. Indian cybersecurity authority CERT-In has not yet weighed in on the issue.

"This incident highlights the critical importance of rigorous process controls during key generation ceremonies, even when utilizing high-level Hardware Security Modules. While eMudhra has confirmed no direct data breach or impact on its core Indian operations, the swift reaction of the market and browser programmes demonstrates how technical vulnerabilities in global segments can immediately influence stakeholder confidence and stock valuation. For businesses relying on digital trust infrastructure, proactive remediation and transparent communication remain essential to mitigating reputational risks." — Dr. Shishir Gupta, Founder & CEO, StartupLanes