eMudhra apologises after weak keys expose 8 intermediate CAs: Here is what it said
Follow UseMudhra apologised after a security flaw exposed eight weak keys.
The company revoked affected certificates and found no evidence of misuse.
Major tech companies blocked affected certificates as eMudhra exits the global SSL/TLS business.
eMudhra has recently posted a public apology on its official website after an incident which exposed the weakness of keys used by its intermediate certificate authorities, which issue digital certificates for websites and code signing. The Indian cybersecurity firm admitted that a scripting error led to the creation of eight easily guessable keys linked to its emSign G3 intermediate certificate authorities. Not only that, but the company also said that it has already revoked the affected certificates and, according to its own investigation, found no evidence of misuse so far. The company has also confirmed that it is exiting the global SSL/TLS business. Here is everything you should know about the eMudhra incident.
SurveyeMudhra: What did the company say?
In a recently posted apology on its official website, the firm said, ‘We want to apologise directly to our customers and to the broader WebPKI community, both of whom were entitled to expect better from us.’ Not only that, but they further added, ‘Also to our partners, who have had to field questions that are ours to answer.’
While describing the event, the company said, ‘Last week, a security researcher reported that the private keys associated with eight of our emSign G3 intermediate TLS CAs were recoverable.’ They also acknowledged it and said, ‘They were right. The flaw was ours. A script error resulted in issuing CAs with weak keys.’
Also read: Central Bank of India RTGS glitch: Is your money safe? Here is what you need to know
eMudhra: What went wrong
The issue came to light last week after a security researcher reported that private keys linked to eight emSign G3 intermediate TLS certificate authorities could be recovered. The keys were expected to be generated randomly as strong P-384 keys. However, a scripting error during a key generation ceremony produced a second, weak set of keys, which were mistakenly used.
The result was keys that were easy to guess and crack, and the researcher’s report on October 17, 2026 showed they could be recovered in under a second. The affected keys were 4, 56, 66, 115, 155, 156, 230 and 237. Six of the eight certificates were for TLS website security and two were for code signing.
eMudhra says no misuse was found
While the company has publicly apologised, it further clarified that its investigation had found no evidence of misuse. According to eMudhra, there was no evidence of a breach involving its infrastructure or customer data.
The company also said the affected authorities had not issued publicly trusted certificates for individual websites or users. However, the weak keys had existed since the key generation in April 2025, so it cannot be ruled out that someone recovered and abused them, although there is no evidence of this. The company says the affected authorities were revoked within 14 hours of discovering the issue.
Apple, Google and Microsoft block certificates
Apple, Google, Microsoft and Mozilla blocked the affected eMudhra certificates after being notified of the problem. Mozilla also removed trust in the emSign ECC Root CA – G3 root, and Chrome is expected to remove it on October 27, so customers with certificates under that root will need to reissue them. On the other hand, Cloudflare and other providers introduced security fixes in response to the incident.
