eMudhra security incident explained: How weak digital keys raised global web security concerns

A digital key is supposed to be almost impossible to guess. But a security incident involving Bengaluru-based eMudhra has shown how a flaw in generating those keys can raise questions about the trust that underpins internet security.

The issue came to light in October 2026, when an independent researcher reported that private keys linked to eight eMudhra intermediate certificates could be recovered because they had been generated with insufficient randomness. Google and Mozilla subsequently moved to block the affected certificates, while India’s Computer Emergency Response Team (CERT-In) issued an advisory on October 21.

The crucial distinction: this is a serious certificate-security incident, but it does not establish that users’ banking details were stolen or that every eMudhra service was compromised.

What is eMudhra, and what went wrong?

eMudhra provides digital identity and trust services, including certificates that help verify websites and secure online communications. Its global web-security business uses digital certificates to help browsers establish encrypted connections with websites.

According to eMudhra’s statement dated October 21, the problem originated during a key-generation ceremony on April 30, 2025. A flaw in the process produced a second set of weak cryptographic keys alongside the intended strong keys. The weak keys were subsequently published in browser trust stores.

CERT-In’s advisory says the affected P-384 elliptic-curve private keys had values small enough to be recovered almost instantly from their corresponding public keys. The problem was with the key-generation process, not a fundamental weakness in the P-384 cryptographic algorithm.

The incident involved eight intermediate certificate authorities, which sit between a root certificate authority and the certificates used to authenticate individual websites or software.

How could weak keys put websites at risk?

Digital certificates help browsers check whether a website is genuine and establish an encrypted connection. If an attacker obtains a certificate authority’s private key, they may be able to create fraudulent certificates and impersonate legitimate websites under certain conditions.

Google’s Chrome Security team said on October 20 that the compromised keys could allow attackers to forge trusted HTTPS certificates. CERT-In also warned of potential “man-in-the-middle” attacks, in which an attacker intercepts or alters communications between a user and a website.

The risks could extend to fraudulent software-signing certificates, which may make malicious software appear to come from a trusted publisher. However, these are potential attack scenarios, not proof that such attacks or data theft occurred.

What have Google, Mozilla and eMudhra done?

Google and Mozilla have blocked the affected certificates in their browser security systems. In its October 20 statement, eMudhra said the incident was limited to eight intermediate certificates within its global trust infrastructure and that none had issued certificates to end users.

The company said it had begun investigating the cause, containing the affected certificates and working with browser and root-store operators to protect users. It also said its infrastructure had not been compromised and that no data breach had occurred.

These are the company’s stated findings; the broader investigation remains important in establishing the full circumstances and any residual risks.

Are Indian digital signature certificates and UPI affected?

CERT-In has made an important distinction: eMudhra’s Indian digital signature certificate and eSign services, regulated by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology (MeitY), are not affected. The incident concerns its separate international web-certificate business.

That means the reported issue should not be confused with a compromise of all digital signatures issued by eMudhra. Cybersecurity expert Pavan Duggal also told ANI that he did not see an immediate risk to the Unified Payments Interface (UPI), which operates on a different platform and framework. That assessment is not a guarantee that every digital service is risk-free.

What should internet users do now?

For most users, the immediate precaution is straightforward: keep browsers, operating systems and applications updated so that security protections and certificate restrictions are applied. Website operators and organisations should review CERT-In’s advisory, check whether their systems rely on affected certificate chains and follow the recommended mitigation steps.

Duggal urged individuals to be cautious about sharing personal information online, saying: “You are the custodian of your own data, and you need to take steps to protect it at a personal level.”

He also called for an investigation into how the weakness arose and how it was handled, arguing: “In this case, an FIR should be registered under the relevant provisions of the Bharatiya Nyaya Sanhita as well as the Information Technology Act. Action should be taken against those responsible for any wrongdoing”.

For now, the incident is a reminder that internet security depends not just on strong encryption, but also on the processes used to generate and manage the keys behind it. The priority is to contain the affected certificates, establish exactly what happened and ensure the same failure cannot recur.

(With inputs from ANI)