eMudhra's Security Incident Raises Concerns: Indian digital certificate provider eMudhra faced a major cybersecurity controversy after eight cryptographically weak keys were discovered in its certificate infrastructure. The incident raised concerns about website security and the reliability of digital certificates. On November 11, 2026, Business Today reported details from the company's incident report explaining the problem.
What Are Digital Certificate Keys? eMudhra operates as a Certificate Authority, issuing digital certificates that help browsers verify website identities and secure connections. Cryptographic keys are essential to this process. The affected keys were intended to be 115 digits long. However, some were extremely short, including one containing only the number four.
A Python Script Error is Blamed: According to Business Today's report, a custom Python script used during key generation contained a software bug. The script was intended to transfer cryptographic keys between two Hardware Security Modules. The error reportedly reduced the size of eight keys, resulting in dangerously weak cryptographic values being generated.
Eight Weak Keys were Identified: The eight affected keys were identified as 4, 56, 66, 115, 155, 156, 230 and 237. Their short lengths made them potentially vulnerable to guessing or brute-force attacks. Such weaknesses could allow attackers to misuse digital certificates and potentially create fraudulent certificates impersonating legitimate websites.
Keys May Have Left Secure Hardware: The report said the Python script also created copies of the keys in an ordinary computer's memory. This raised concerns that sensitive cryptographic material could exist outside protected hardware. eMudhra subsequently revoked all 16 certificates associated with the affected keys as a precautionary security measure.
Technology Companies Responded: Google, Mozilla, Apple and Microsoft released security updates following the incident to prevent potential exploitation of affected certificates. eMudhra also changed its key-generation approach, avoiding transfers between Hardware Security Modules. The company announced its exit from the digital certificate business and promised an expert review.
What Did eMudhra Say About the Incident? There is an important distinction between the reported explanation and the company's public statement. eMudhra confirmed weak keys and their revocation but said its exact root cause remained under investigation. It also said no certificates had been issued from affected intermediates and no data breach was identified.