eMudhra Key Compromise: How One Ceremony Flaw Shook Internet Trust

On Saturday, 17 October, a security researcher identified only as Wayne sent the world’s browser makers a short message signed with eight different private keys. The message read: “We have a problem here – Wayne.” Each of those keys belonged to an intermediate certificate authority run by eMudhra, the Bengaluru-headquartered company that is one of India’s licensed Certifying Authorities. None of them should have been in anyone’s hands but eMudhra’s. Wayne had not stolen them. He had worked them out, because they were small enough to guess.

Within three days, Google, Mozilla, Apple and Microsoft had blocked the certificates, Mozilla had dropped one of eMudhra’s root certificates entirely, and the Ministry of Electronics and Information Technology (MeitY) had set up a special team to investigate. eMudhra’s shares lost about a third of their value in two trading sessions. This explainer sets out what went wrong, who is affected, and what the alarming posts circulating on social media got right and wrong.

What a Certificate Authority Actually Vouches For

Every time a browser shows a padlock next to a website’s address, it has checked a digital certificate that says, in effect, “this really is the bank’s website”. Certificate authorities issue those certificates and sign them with a private key. Browsers trust a small list of root authorities, and the roots in turn sign intermediate authorities that do the day-to-day issuing.

Whoever holds an intermediate’s private key can sign a certificate for any website, and software that trusts the chain will accept it. That is why Mozilla cryptography engineer Dennis Jackson, who made the incident public on 20 October, wrote that “the impact of this incident could not be higher”. With a valid-looking certificate, an attacker who can sit between a user and a website, on public Wi-Fi or a compromised network, could read or change traffic that the user believes is private.

A Private Key That Was the Number 4

The affected keys use an elliptic-curve scheme called P-384. A proper P-384 private key is a random number more than 100 digits long, with roughly 10¹¹⁵ possibilities, far too many to guess. eMudhra’s eight keys were all below 256, so an attacker needed at most 256 guesses.

Security researcher Scott Helme, who analysed the certificates, recovered all eight on a laptop in under a second. “One of eMudhra’s certificate authority private keys is the number 4,” he wrote. The others he cited included 56 and 115. “The key was effectively public from the day the certificate existed,” he said, quoted by Help Net Security.

How the April 2025 Key Ceremony Went Wrong

Certificate authorities create their keys at formal “key ceremonies”, inside tamper-resistant hardware security modules, with auditors watching. eMudhra says its keys were generated on FIPS 140-2 Level 3 modules at a ceremony on 30 April 2025, where 24 intermediates were created. Sectigo, a larger certificate authority, cross-signed the eight affected ones in May 2025.

According to eMudhra’s statement, one step of the ceremony, a key wrap and unwrap step, “produced a second, weak set of keys alongside the original strong keys”. Help Net Security reported that the weak keys had labels similar to the real ones, so staff picked the wrong set, and the weak set was what went to the browsers’ trusted lists. eMudhra has admitted human error at several steps and says it has not yet confirmed the root cause.

There was an early warning. In June 2025, invalid signatures on certificate revocation lists from the same intermediates were reported and put down to a manual process error, SOCRadar said. eMudhra now links them to the same key mismatch. The flaw then went unnoticed for about 17 to 18 months, through two independent audit cycles.

Four Days, Every Major Browser

Google said no website certificates chaining to the six intermediates had appeared in public Certificate Transparency logs before its block. Modern browsers refuse certificates that are not in those logs, so they could not have been fooled by a forged certificate from these keys.

Aadhaar eSign and Digital Signatures: What MeitY Says

For most Indians, eMudhra is known for Digital Signature Certificates used to file tax returns and company documents, and for Aadhaar-based eSign. MeitY said the problem is limited to eMudhra’s global website-security business, which runs under an international trust framework audited by BDO International, and that the DSC and eSign services, regulated by the Controller of Certifying Authorities, are not affected. “The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said, as reported by ANI. It also warned against “fear mongering” on social media.

eMudhra said its digital signature and eSign businesses run on separate infrastructure, that its root keys and other intermediates were not affected, and that no data was breached. CERT-In’s advisory, CIAD-2026-0050, said public disclosures had not established any confirmed malicious use as of 21 October.

Servers, Scripts and Old Devices Still Need Updates

Browsers update their trust lists quickly. Much other software does not. Command-line tools, programming languages, containers and internet-connected devices often carry their own copy of the trusted list and do not check revocations. Helme said his tests showed curl, Python, Node.js, Go and Java accepting a forged certificate for Stripe’s payment API made with one of the eMudhra keys, CoinDesk reported.

• Developers and IT teams: update operating system certificate packages and language bundles. The fixed versions include Go 1.27.3 and 1.26.10, Python’s certifi 2026.10.19, and Node.js 26.12.1, 24.22.1 and 22.23.4. Go programs must be rebuilt to pick up the fix.
• Website owners with eMudhra certificates: Google says sites whose certificates chain to emSign ECC Root CA – G3 must get a new certificate from another authority before 27 October, or Chrome will stop trusting them. eMudhra says this affects one customer ecosystem in the United States, which it is moving to another provider. Help Net Security reported that eMudhra estimates about 30,000 customer certificates need replacing.
• Ordinary users: keep the browser and phone updated. No other action is needed.

Read IPB’s reports on the Node.js release that blocks the eMudhra keys and the PHP2Shell flaws patched the same day.

Shares Down a Third in Two Sessions

eMudhra’s shares fell 20% on Wednesday, 21 October, from ₹540 to ₹432, hitting the lower circuit. On Thursday they opened at ₹385 and were trading at ₹361.95 on the NSE at 12:04 pm, a two-day fall of roughly 33%, the Free Press Journal reported. eMudhra has said its global website-certificate business brings in about 1% of revenue, and has acknowledged a reputational risk it could not put a number on.

What the Viral Posts Got Wrong

A widely shared post on X this week said eMudhra’s keys “forged ANY website for 17 months” and put “60M+ certs at risk”. Part of that is accurate: the keys were weak from April 2025, about 17 months before the report, and could have been used to sign a certificate for any website. But the evidence so far does not show that anyone did. Google found no such certificates in Certificate Transparency logs, and CERT-In says no malicious use has been confirmed.

The 60 million figure is the number of digital certificates eMudhra says it has issued over its history, mostly for digital signatures, which MeitY says are unaffected. It is not the number at risk. eMudhra says the eight compromised intermediates issued no customer certificates at all; the certificates that need replacing are those under the root that browsers are now removing.

Questions eMudhra Still Has to Answer

eMudhra has promised to publish its root cause and investigation findings. Two questions stand out: how a ceremony watched by auditors produced keys this weak, and why the June 2025 signature errors did not lead anyone to check the keys. Google says it checked the other keys in its root store and found none with the same weakness. Google is reviewing whether eMudhra’s remaining certificates, including emSign Root CA – G1, should stay in the Chrome Root Store. MeitY says it will share details once its team finishes. IPB News will update this report when those findings are released.

Frequently Asked Questions

Is my Aadhaar eSign or Digital Signature Certificate safe?

Yes, according to MeitY and eMudhra. The compromised keys belong to eMudhra’s global website-certificate business. DSC and eSign services run on separate infrastructure regulated by the Controller of Certifying Authorities and are not affected.

Do ordinary internet users need to do anything about the eMudhra incident?

Only keep browsers and phones updated. Chrome, Firefox, Safari and Edge blocked the certificates between 17 and 20 October. Developers and IT teams need to update certificate lists in servers, programming languages and devices.

Source: eMudhra statement on the certificate security incident; Google Security Blog; eMudhra Intermediate CA Compromise disclosure site. Also based on reporting by The Hacker News, Help Net Security, The Register, CoinDesk, SOCRadar, Business Today, ANI and Free Press Journal.

Image: The Hacker News.