MUMBAI: Bengaluru-based digital trust and cybersecurity company eMudhra has acknowledged a cryptographic flaw that generated weak keys in its global website-certificate business, potentially exposing them to attackers.The keys establish trust between websites and visitors’ browsers. eMudhra said it is working with potentially affected customers to issue replacement Transport Layer Security (TLS) certificates and avoid disrupting critical services.It is also coordinating with browser root programmes operated by Google, Apple, Microsoft and Mozilla to address the issue. The company has not disclosed a complete remediation timeline or a list of affected customers.The incident triggered online discussion because eMudhra is a major provider of Class 3 Digital Signature Certificates (DSCs) and USB tokens used by companies and tax professionals to sign documents and file GST returns and other registrations.However, the current incident concerns its global TLS website-certificate business, not its Indian DSC and eSign operations, which run on separate infrastructure.“This incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally,” the company said.Shares of eMudhra fell 20% on the BSE following the news of the security flaw. The affected global TLS business accounts for around 1% of eMudhra’s revenue, the company said, while acknowledging that the reputational impact could not be quantified.
What went wrong with eMudhra’s website certificates?
“A flaw in the KGC (key generation ceremony) caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” eMudhra said in its filing.The company is investigating how the flaw occurred, despite the affected certificate authorities having undergone independent audits for two consecutive years and being included in browser trust lists since mid-2025.An independent researcher discovered last weekend that the weak keys could potentially be reverse-engineered, possibly using AI-assisted techniques, and alerted Apple, Google, Microsoft and Mozilla.eMudhra said its infrastructure had not been compromised, no data had been breached and its physical and logical security controls remained intact. These are the company’s assertions; the root-cause investigation is ongoing.The incident presents two potential risks: an attacker could use reconstructed keys to impersonate a website, while the withdrawal of browser trust could disrupt legitimate websites relying on affected certificate chains.There are also reports that Google may remove the eMudhra root certificate from Chrome’s trust store, potentially affecting websites that have not migrated to an accepted certificate chain.
What is eMudhra
Founded in 2008, eMudhra is a Bengaluru-based digital trust and cybersecurity company located at Hi-Tech Defence and Aerospace Park in Jala Hobli, Bengaluru, Karnataka.It provides digital trust and cybersecurity solutions for businesses. Its portfolio includes Public Key Infrastructure (PKI), digital signatures, SSL/TLS certificates, identity and access management, multifactor authentication, document signing and digital workflow platforms.The company also specialises in Zero Trust security, cryptography, paperless transformation and post-quantum cryptography.
