Bengaluru: A serious cryptographic flaw involving digital certificates issued by Indian cybersecurity company eMudhra has raised international concerns about the systems that help establish trust across the internet. Nisarga Adhikary, a young ethical hacker known for identifying vulnerabilities in the CBSE website, has described the incident as an “absolute disaster”, warning that the consequences could have been severe if technology companies had not acted quickly.
The controversy centres on eight intermediate certificate authority (CA) certificates whose private cryptographic keys were generated with dangerously little randomness. Such certificates form part of the infrastructure that allows browsers to verify whether websites are genuine and whether encrypted connections can be trusted.
The discovery prompted major technology companies, including Google, Apple, Microsoft and Mozilla, to block the affected certificates. eMudhra subsequently announced its decision to exit the global Transport Layer Security (TLS) certificate business, while investigations into the flaw continued.
Although the incident raised the possibility of fraudulent websites impersonating legitimate services, there is no confirmed evidence that the weak keys were exploited to carry out attacks. eMudhra has also said that none of the affected intermediate certificates was used to issue certificates for individual websites.
Nisarga Adhikary calls the incident an avoidable disaster
Nisarga Adhikary said the incident could have been avoided with stronger security practices. He welcomed the response from major technology companies, which moved to limit the potential damage by blocking the affected certificates.
Nisarga previously came to public attention for identifying security vulnerabilities in the Central Board of Secondary Education (CBSE) website. His comments on the eMudhra case have drawn attention to the importance of rigorous testing and verification in systems responsible for protecting online communications.
The incident is particularly significant because digital certificates are part of the internet’s underlying trust infrastructure. Most users rarely think about how their browsers determine whether a website is authentic. They generally rely on the browser to validate the site’s certificate and establish a secure connection.
If a certificate authority’s private keys become predictable, an attacker could potentially misuse them to create fraudulent certificates that appear trustworthy to software relying on that authority. This could expose users to impersonation and interception risks.
Nisarga’s warning highlights how a seemingly technical error in cryptographic key generation can have consequences far beyond the organisation responsible for it. However, the potential impact must be distinguished from confirmed damage: the investigation has not established that the affected keys were used to compromise customer accounts or steal data.
What went wrong with eMudhra’s cryptographic keys?
The affected keys were generated during a key-generation process in April 2025. According to reports, a flaw in the process resulted in keys that were far weaker than the cryptographic standard required.
A secure private key must be generated using sufficient randomness to make guessing it computationally impractical. The affected keys, however, corresponded to the extremely small values 4, 56, 66, 115, 155, 156, 230 and 237.
These values are extraordinarily easy for a computer to test. Instead of facing the enormous search space expected from a properly generated cryptographic key, a researcher could examine the limited range of possible values and recover the affected keys very quickly.
The problem involved eight intermediate CA certificates. These certificates are used within the certificate hierarchy to help establish the authenticity of website certificates and other digital identities.
If an attacker obtained a usable private key belonging to a trusted certificate authority, it could potentially be used to sign fraudulent certificates. Depending on the certificate’s permissions and how systems validate it, this could enable an attacker to impersonate legitimate websites or services.
Grant Thornton Bharat partner Akshay Garkel told India Today Tech that the failure should have been detected through rigorous cryptographic testing, secure key generation and independent security validation. His assessment underlines the importance of testing whether security controls work in practice rather than assuming that compliance procedures alone are sufficient.
How the flaw could have affected internet users
Digital certificates are a crucial part of the system that protects connections between browsers and websites. When a user visits a banking website, an online shopping platform or another secure service, the browser checks the site’s certificate as part of establishing a trusted connection.
A compromised certificate authority key could potentially allow an attacker to create a fraudulent certificate that appears to be valid. A fake website could then imitate a genuine service, potentially misleading users into entering passwords, financial information or other sensitive details.
In some circumstances, a fraudulent certificate could also help an attacker intercept or manipulate communications that users believe are secure.
The risk was not limited to a single website because certificate authorities can support trust across multiple services. This is why the discovery attracted an international response from browser developers and other technology companies.
However, the flaw did not mean that every website secured by eMudhra was compromised. The company said only one of the eight affected intermediate certificates had been deployed in production, and none had been used to issue certificates for individual websites.
The distinction matters: the weak keys created a serious potential security risk, but the available information does not establish that attackers used them to intercept real-world traffic or steal customer data.
Google, Apple, Microsoft and Mozilla block affected certificates
After independent researcher Wayne identified the issue and alerted major technology companies, browser developers moved to prevent the affected certificates from being trusted.
Google, Apple, Microsoft and Mozilla took steps to block the certificates in their respective software ecosystems. Cloudflare and other providers also introduced measures intended to reduce the risk of misuse.
The swift response was an important part of containing the immediate threat. Blocking affected certificates prevents supported software from continuing to rely on them as trusted authorities, reducing the opportunity for an attacker to exploit the weak keys through those systems.
CERT-In, India’s national cybersecurity agency, issued an advisory on the incident and recommended mitigation measures, including updating browsers and operating systems.
Nevertheless, browser updates do not necessarily address every possible point of exposure. Some applications, older devices, enterprise systems and network equipment maintain their own certificate stores or depend on updates from individual manufacturers. These systems may take longer to receive fixes.
Security experts have therefore cautioned that organisations should review the software and devices they operate rather than assuming that browser protections alone resolve every risk.
Experts question security testing and audits
The incident has prompted questions about how the flawed keys passed through the company’s security processes undetected.
Cybersecurity experts quoted by India Today Tech said stronger cryptographic testing and independent validation should have identified the problem. The fact that the keys were generated in April 2025 and discovered in October 2026 also raised questions about the effectiveness of the checks conducted during that period.
Govind Rammurthy, chief executive of eScan, said the weak keys could theoretically have allowed fraudulent certificates to be created for services such as banking websites, email providers and government portals. Akshit Kaushik Devgun, co-founder of Mitigata, said the wider consequence was damage to confidence in the digital trust infrastructure.
The incident demonstrates why certificate authorities must follow strict procedures during key generation, certificate issuance, auditing and incident response. Security controls need to be independently tested and continuously monitored, particularly when a failure could affect trust beyond an individual company.
The investigation must still establish the precise technical cause, how the flaw passed through existing checks and what further safeguards are needed to prevent a recurrence.
eMudhra exits global TLS certificate business
Following the controversy, eMudhra announced that it would voluntarily exit its global TLS certificate business. The company cited a combination of reputational pressure, social media backlash and the increasing complexity and cost of meeting global compliance requirements.
The company has maintained that the incident was limited to the affected intermediate certificates and did not compromise its root CA private keys or other intermediate authorities. It has also said its Indian digital signature certificate and eSign services operate on separate infrastructure and were not affected by this particular issue.
Reuters reported that the TLS business represented approximately 1% of eMudhra’s revenue, although the reputational consequences could be more difficult to quantify. The decision to leave the business marks a significant response to a flaw that drew attention well beyond the company’s immediate customer base.
What users should do now
For ordinary internet users, the most practical steps are to keep browsers and operating systems updated, install security updates when they become available and remain cautious about suspicious websites.
Users should not assume that a padlock symbol alone guarantees that a website is legitimate. It indicates that a connection has met certain security checks, but it does not prove that a business is genuine or that a user has reached the intended service.
Organisations should also inventory their software and connected devices, review relevant security advisories and ensure that certificate-related updates are applied wherever required.
The eMudhra incident has exposed how a basic failure in key generation can create risks for a much broader digital ecosystem. The rapid response from major technology companies helped contain the immediate danger, but the episode has renewed scrutiny of certificate authorities and the controls that underpin online trust.
For Nisarga Adhikary and other security researchers, the case is a reminder that strong cryptography is only effective when it is implemented correctly, tested thoroughly and monitored throughout its lifecycle.