Bengaluru: A cybersecurity flaw involving digital certificate keys issued by Indian cybersecurity firm eMudhra has raised serious concerns about the security infrastructure that helps websites establish their identity online. Nisarga Adhikary, the teenage ethical hacker known for identifying vulnerabilities in the CBSE website, has described the incident as an “absolute disaster” that could have been avoided through stronger security checks.

The controversy centres on a set of digital certificates containing cryptographic keys that were reportedly so weak that they could be guessed with minimal effort. Such keys are expected to protect the authenticity of digital certificates, which browsers use to determine whether websites can be trusted.

The issue prompted major technology companies, including Google, Apple, Microsoft and Mozilla, to take steps to block the affected certificates. India’s cybersecurity agency, CERT-In, also issued an advisory urging users to update their browsers and operating systems.

eMudhra has since exited the Transport Layer Security (TLS) certificate business, with the company citing social media trolling among the reasons for its decision. It has maintained that the vulnerable keys were not used to issue certificates for websites.

Although the immediate risk was mitigated, cybersecurity experts have warned that the incident raises broader questions about cryptographic testing, independent security audits and the reliability of the systems that underpin online trust.

What went wrong with eMudhra’s digital certificate keys?

Digital certificates play a critical role in securing internet communications. They help browsers verify the identity of websites and establish encrypted connections through protocols such as TLS. When a website has a valid certificate, browsers can display a padlock symbol to indicate that the connection is secure.

The eMudhra controversy involved cryptographic keys that were supposed to be sufficiently random and difficult to predict. According to the report, some of the affected keys were associated with the unusually small numbers 4, 56, 66, 115, 155, 156, 230 and 237.

These values were a serious departure from the expected security of properly generated cryptographic keys. If a certificate authority’s trusted signing key can be predicted or reproduced, an attacker may be able to create fraudulent certificates that appear legitimate to systems trusting that authority.

In a hypothetical attack, a criminal could attempt to make a fake banking website appear authentic by using a fraudulent certificate. If a vulnerable system accepted that certificate, it could create opportunities for impersonation or interception of communications.

However, the reported weakness does not mean that every website using eMudhra certificates was compromised. The company said the affected keys had not been used to issue website certificates, and the available report did not establish that customer data had been stolen.

The distinction is important because the incident exposed a potential weakness in the certificate infrastructure rather than confirming a successful attack against individual websites.

Google, Apple and other technology companies respond

The vulnerability was brought to the attention of major technology companies by security researcher Wayne, who informed Google, Apple, Microsoft and Mozilla about the affected keys.

According to the report, the companies acted within hours to block the affected certificates from their browsers. These measures were intended to prevent the vulnerable certificates from being accepted as trustworthy by supported browser systems.

The response helped contain the immediate threat and reduced the possibility that attackers could exploit the weakness through browsers that had implemented the necessary protections.

CERT-In also advised users to update their browsers and operating systems to the latest available versions. Security updates are important because certificate trust decisions can depend on the software’s current list of trusted and distrusted certificate authorities.

Nisarga welcomed the response from the major technology companies, saying their actions helped mitigate and control the damage. His assessment highlighted the importance of coordination between independent researchers, browser developers and cybersecurity authorities when vulnerabilities affect widely used internet infrastructure.

Nevertheless, the incident has raised questions about how the weak keys remained undetected after being generated in April 2025.

Teen hacker Nisarga Adhikary calls incident avoidable

Nisarga Adhikary, who previously identified a critical vulnerability in the CBSE website, said the eMudhra incident could have been prevented with appropriate security controls.

His comments reflect concerns that organisations responsible for digital trust infrastructure must maintain rigorous standards for key generation, validation and monitoring.

The incident has drawn attention to the difference between having security procedures on paper and ensuring those procedures work effectively in practice. Cryptographic systems require careful implementation because even a basic mistake can undermine otherwise sophisticated protection mechanisms.

Akshay Garkel, partner at Grant Thornton Bharat, also questioned why the weakness was not detected earlier. He told India Today Tech that rigorous cryptographic testing, secure key generation and independent security validation should have identified the problem.

Garkel emphasised that critical security controls must be tested for effectiveness rather than merely checked for compliance.

The comments underline the importance of testing cryptographic keys immediately after they are generated and before they are used in security-sensitive systems. Automated checks and independent reviews can help identify keys that do not meet expected security standards.

Experts question eMudhra’s audits and operational controls

Govind Rammurthy, chief executive of eScan, warned that the weakness could have created opportunities for attackers to set up fraudulent websites that appeared genuine.

He pointed to the simplicity of one of the reported key values, saying one of them was literally the number 4. According to Rammurthy, attackers could have calculated the affected keys from publicly available certificate data in milliseconds.

He also raised concerns about the company’s internal processes, arguing that a basic check after key generation should have identified the problem.

The keys were reportedly generated in April 2025 but remained undetected until the issue surfaced in October 2026. That timeline has prompted questions about the effectiveness of the company’s security reviews and auditing procedures.

However, the available information does not independently establish the precise scope of any audit failure. The central concern raised by experts is that security controls should be capable of detecting weak cryptographic material before it becomes part of a trusted system.

For organisations operating certificate infrastructure, such checks are essential because a failure can affect the confidence that browsers, businesses and users place in digital identities.

Why the incident threatens trust in online security

Akshit Kaushik Devgun, co-founder of Mitigata, said the biggest casualty of the incident was trust in the digital infrastructure used to authenticate websites.

He noted that even without confirmed evidence of customer data theft, weaknesses in certificate systems can create opportunities for impersonation and interception of online communications.

Digital certificates are designed to establish confidence that users are connecting to the intended website. If the underlying cryptographic keys are weak, the security assurances provided by those certificates may be undermined.

The incident also highlights why the padlock symbol displayed in a browser should not be interpreted as a guarantee that a website or its operator is entirely safe. It indicates aspects of the connection’s security and certificate validation, but it cannot independently prove that a business is legitimate or that every component of its security infrastructure is free from vulnerabilities.

Devgun said organisations must identify why the key-generation controls failed and ensure the same weakness cannot recur. He stressed that critical security controls need to be validated rather than simply assumed to be functioning.

The episode has therefore renewed attention on the need for independent testing, effective oversight and transparent incident response among companies that provide foundational cybersecurity services.

What does the eMudhra incident mean for internet users?

For most users, the immediate recommendation is to keep browsers and operating systems updated. Google Chrome, Apple’s Safari and other major browsers have taken steps to block the affected certificates, helping reduce the risk for users running supported and updated software.

However, experts have warned that browser protections may not cover every system equally.

Some software products maintain their own trusted certificate lists rather than relying entirely on the operating system or browser. These may include payment terminals, older Android devices, banking applications and enterprise systems.

Such products depend on their respective manufacturers and software providers to distribute updates and revise certificate trust settings. If an affected system does not receive the necessary protections, the period of exposure could be longer.

Rammurthy cautioned that the time between the generation of the keys in April 2025 and the discovery of the issue in October 2026 cannot be fully accounted for across all systems.

Users should therefore install official software and security updates promptly, avoid ignoring certificate warnings and verify website addresses before entering passwords or financial information. Businesses should also review their systems’ certificate trust stores and follow guidance from their software vendors and security teams.

There is no confirmed evidence in the supplied report that the weak keys were used to compromise websites or steal customer information. Nevertheless, the potential consequences were serious enough to prompt coordinated action by major technology companies.

eMudhra exits TLS certificate business amid scrutiny

Following the controversy, eMudhra announced its exit from the TLS certificate business and cited social media trolling among the factors behind its decision.

The development has added another dimension to the incident, which has moved beyond a technical vulnerability to questions about accountability and confidence in digital security providers.

The immediate response by browser developers appears to have helped contain the risk associated with the affected certificates. However, the wider questions raised by the incident remain relevant to the cybersecurity industry.

The eMudhra episode demonstrates how a seemingly basic failure in cryptographic key generation can potentially undermine a critical layer of internet security. It also shows why effective testing, independent validation and timely software updates are essential.

While the available information does not establish that the weakness was exploited to steal data, experts say organisations must investigate the failure and strengthen safeguards to prevent a recurrence. Ultimately, protecting online trust requires more than a padlock symbol: it depends on the integrity of the systems and security controls operating behind it.