What went wrong with eMudhra's digital certificates and what users need to know

The Ministry of Electronics and Information Technology has set up a special team to investigate a security incident involving digital certificate provider eMudhra, after weak cryptographic keys exposed eight intermediate certificates used in its global website-security business to potential misuse.

The Indian Computer Emergency Response Team (CERT-In), in an advisory dated October 21, said that private keys associated with six Transport Layer Security (TLS) certificates and two code-signing certificates could be recovered almost instantly because they had been generated with “insufficient cryptographic randomness.”

“An attacker possessing these private keys could issue fraudulent certificates for domains they do not control,” the agency said.

The code-signing keys could also be used to make malicious software appear to have been signed by a trusted publisher.

"The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service," Cloudflare CEO Matthew Prince posted on X.

"The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this," he added.

eMudhra said its infrastructure had not been compromised and no data had been breached.

“This incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses,” the firm said. “The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally.”

The Ministry of Electronics and Information Technology (MeitY), in a series of posts on X, said it had taken serious note of the incident and constituted a special team to investigate it.

The impact on Indian websites and applications had been “very limited and for a very short interval”, it added.

Browser companies block affected certificates

Mozilla blocked the six affected TLS intermediate certificates through its OneCRL certificate block list and issued updates for Firefox and its extended support release versions.

Google also blocked the affected public keys in Chrome and announced plans to remove the emSign ECC Root CA - G3 certificate from its Chrome Root Store on October 27.

The removal could cause otherwise legitimate certificates linked to the root to become untrusted, potentially disrupting some websites and services, CERT-In said.

Google reported that no TLS certificates linked to the six affected intermediates had appeared in Certificate Transparency logs before its blocking action.

Internet infrastructure company Cloudflare said it had rolled out security fixes across its services after became aware of the incident at around 1700 GMT on October 19.

"This is a serious security incident with implications across the Internet," Cloudflare said in a blog post.

The company said customers using Cloudflare Zero Trust with its Gateway service and an up-to-date client were automatically protected, but some users would need to update software or review their own certificate trust configurations, particularly on origin servers.

eMudhra said the issue involved eight of several intermediate certificate authorities used in its global TLS business. The certificates were created under its elliptic-curve cryptography (ECC) root during a key-generation ceremony on April 30, 2025.

A flaw in the ceremony caused a wrap-and-unwrap step to produce a second set of weak keys alongside the original strong keys, the company said. The weak keys were the ones published to browser root stores.

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques," eMudhra said. "The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla."

The certificates had been included in browser trust lists since mid-2025 and had undergone independent audits for two consecutive years, eMudhra said, adding that it was working to establish the root cause.

Limited revenue exposure

The affected global TLS business accounts for around 1% of eMudhra's revenue, the company said.

“However, this may have some reputational risks on eMudhra which cannot be quantified,” it added.

eMudhra said it was working directly with potentially affected customers to provide replacement certificates and avoid disruption to critical services. It was also working with browser root programmes as its investigation continued.

MeitY said the international certificate business operates under a global trust framework and is subject to independent audits, including WebTrust audits conducted by BDO International Limited. The ministry clarified that it was not involved in auditing that business.

The ministry said India's regulated digital signature and eSign services remained completely unaffected.

CERT-In advised organisations to update browsers and certificate trust stores, review services relying on the affected certificates, replace certificates where necessary and monitor for unauthorised certificate issuance. It also urged software vendors and administrators to verify code-signing certificate chains and avoid bypassing certificate-validation warning.