eMudhra Faces Cybersecurity Scrutiny After Weak Certificate Keys Raise Website Security Concerns

eMudhra is facing questions about its security practices after eight intermediate certificate authority keys linked to its global website security business were found to be vulnerable. The weakness raised concerns that attackers could potentially create fraudulent HTTPS certificates and impersonate legitimate websites.

The keys were generated on April 30, 2025, but the issue went undetected for around 18 months, according to a statement issued by eMudhra on October 21, 2026.

While the company has said that its infrastructure remains secure, no customer data has been compromised, and its Indian digital-signature and eSign services are unaffected, browser companies have moved to block the affected certificates as a precaution.

How the Weak Certificate Keys Created a Security Risk

Certificate authorities (CAs) play a crucial role in establishing trust on the internet. They verify the identities of websites and issue digital certificates that allow browsers to confirm that users are connecting to legitimate services.

Intermediate certificate authorities operate under root certificates trusted by browsers and operating systems. If the keys associated with these intermediate authorities are weak, attackers may be able to exploit them to create fraudulent certificates and make malicious websites appear trustworthy.

According to eMudhra, a key-wrapping and unwrapping step in its key-generation process resulted in the creation of a second set of weak keys. After that, these keys were made available to browser root stores.

The company said its root private key was not compromised. However, the incident prompted browser operators to withdraw trust from the associated emSign ECC Root CA - G3 to limit potential risks.

The vulnerability might enable attackers to counterfeit trusted HTTPS certificates and impersonate websites for users whose browsers had not yet ceased trusting the compromised certificate authority, according to a warning from Google's Chrome Security team.

Google has blocked the affected intermediate keys and plans to remove the parent root certificate from Chrome's trust store starting October 27, Pacific time. As a result, some legitimate websites that rely on certificates issued under that root may experience disruptions in Chrome.

Mozilla also responded quickly, blocking the affected certificates in Firefox within three hours of receiving the report. It subsequently released software updates to extend protection to users who might not receive automatic security measures.

eMudhra Says Customer Data Remains Safe

Although the incident has raised concerns about online trust and certificate security, the immediate impact appears limited. The investigation, however, is still underway.

eMudhra said none of the eight affected intermediate certificate authorities had issued certificates directly to end users. The company also stated that its infrastructure had not been compromised and that no data breach had occurred.

One customer ecosystem in the United States has been identified as affected, and certificates associated with it are being replaced.

The business also made it clear that the event had no impact on its eSign and digital-signature services in India, which run on different infrastructure.

However, eMudhra has not yet established the precise cause of the weakness. It said it would disclose the findings once its investigation is complete.

The uncertainty leaves questions about how the flaw was introduced and why it remained undetected for such an extended period.

Questions Over Security Controls and Audits

The incident has drawn attention to the safeguards used by companies that provide digital certificates and other online trust services.

HTTPS certificates assist browsers in establishing secure connections and confirming the legitimacy of websites. But encryption alone cannot guarantee that a website is legitimate. The reliability of the certificate authority issuing the certificate is equally important.

Browser companies maintain trusted certificate lists and can revoke trust in certificates or authorities when security concerns emerge. These measures help prevent users from relying on certificates that may no longer be considered safe.

Certificate Transparency logs, which publicly record certificate issuance, also provide a way to identify suspicious or unexpected certificates. Even with such safeguards in place, the eMudhra incident raises questions about the effectiveness of internal security checks.

In particular, the fact that the weakness reportedly went unnoticed through two audit cycles has placed the company's key-generation and validation procedures under scrutiny.

What eMudhra Is Doing Next

eMudhra has said it is reviewing its key-generation processes as part of its response to the incident.

The company is also offering enterprise customers certificates issued through an additional certificate authority. The move is intended to reduce dependence on a single chain of trust and provide an alternative for customers who may be affected by changes to browser trust policies.

The study must determine how the weak keys were made, why the issue was not discovered sooner, and what adjustments are needed to stop a repeat of this.

The episode reminds the larger digital-trust sector that encryption technology is not the only factor that affects online security. Certificate authorities must also maintain reliable key-generation processes, effective monitoring and strong internal controls.

When a trusted certificate authority develops a security weakness, the consequences can extend beyond the company itself, potentially affecting browsers, enterprise customers and website operators that depend on its certificates.