“The flaw was ours”, the Indian firm apologises after a script error weakened keys that could have let hackers fake trusted websites
eMudhra has publicly owned up to a security lapse that sent alarms ringing across the internet last week.
The Indian cybersecurity firm has apologised after it emerged that it had issued digital certificates for websites using dangerously weak security keys. Such keys could have let attackers build fake websites that looked genuine. The company has now promised a full explanation and an independent review of its procedures.
“The flaw was ours”
“We want to apologise directly to our customers and to the broader WebPKI community, both of whom were entitled to expect better from us,” eMudhra said in a statement. “Also to our partners, who have had to field questions that are ours to answer.”
WebPKI, or Web Public Key Infrastructure, is the global trust framework that lets browsers and operating systems verify the identity of websites and platforms through digital certificates.
“Last week, a security researcher reported that the private keys associated with eight of our emSign G3 intermediate TLS CAs were recoverable,” the statement added. “They were right. The flaw was ours. A script error resulted in issuing CA’s with weak keys.”
What went wrong
Each of the eight keys was meant to be generated randomly at 384 bits, a number about 116 digits long. A scripting error instead produced keys that were found to be shockingly simple to guess and crack. The keys were 4, 56, 66, 115, 155, 156, 230 and 237.
No misuse, says the company
eMudhra says it acted within hours of learning of the problem. “The affected intermediate CAs were revoked within 14 hours of our confirming the issue,” the statement said.
The weak keys had been in its systems since April 2025, but the company says they were not misused. “Based on our investigation to date, the affected intermediates had not issued publicly trusted end-entity certificates, and there has been no compromise of our infrastructure or customer data,” it added.
Root-cause analysis and expert review
eMudhra will publish a full root-cause analysis through the Common CA Database (CCADB) process. “It will explain what went wrong, why our controls failed to detect it, and the changes we are making as a result,” the company said.
It is also bringing in outside scrutiny. “We are also commissioning an independent expert to review the incident and the procedures and controls followed by us,” the company added. “Nothing is more important in our business than the trust placed in us by our customers and the broader digital-trust ecosystem.”
Fallout so far
The incident has already had wide consequences. eMudhra has announced it is leaving the TLS certificate business and moving all its TLS customers to “alternate certificates at no cost.” Shortly after being notified, Apple, Google, Microsoft and Mozilla blocked the affected certificates, while Cloudflare and other providers issued security fixes. Co-founder Kaushik Srinivasan told India Today Tech: “Our control and failure lapses happened. It was a script error. We should have checked. It did not happen.” Meanwhile, the Ministry of Electronics and Information Technology (MeitY) has set up a special team to investigate the incident.
